CWE-639
CVEs classified under CWE-639, newest first.
1299 CVEsRSS
CVE-2026-9799Medium· 4.6Keycloak allows unauthorized access to resources via uma permission ticket bypass
Keycloak allows unauthorized access to resources via uma permission ticket bypass
CVE-2026-117574Critical· 9.1Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization
A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service do…
CVE-2026-118668HighLangGraph JavaScript custom authentication may permit cross-user Store access
LangGraph JavaScript custom authentication may permit cross-user Store access
CVE-2026-58273High· 8.8rucio has an Authorization Bypass on REST API endpoint for signing URLs
rucio has an Authorization Bypass on REST API endpoint for signing URLs
CVE-2026-59979High· 8.3YosemiteCrew: Missing organization authorization on service and PMS library/template routes
YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. `authorize…
CVE-2026-87098Low· 3.1Sensitive information disclosure due to improper authorization
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
CVE-2026-111961Low· 3.8Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page
The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full conte…
CVE-2026-117606Medium· 5.4NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding …
CVE-2026-117605Medium· 4.3nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership.…
CVE-2026-109848Medium· 4.2GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the c…
CVE-2026-105272Medium· 4.2GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and c…
CVE-2026-59185High· 8.5identrail: Cross-tenant GitHub installation binding without ownership verification
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` …
CVE-2026-116672High· 8.8Authlib RFC 7592 examples omit registration-access-token client binding
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations l…
CVE-2026-116898High· 7.1REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category…
CVE-2026-16307Medium· 4.3IDOR in Netiket Information Technologies' EdoWEB
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
CVE-2026-117563Medium· 5.4MrDoc through 1.1.1 Broken Access Control via manage_doc_share
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers ca…
CVE-2026-117562Medium· 5.3rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offse…
CVE-2026-116899Medium· 6.5REDAXO before 5.21.4 Broken Access Control in Slice Operations
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit de…
CVE-2026-116746Medium· 5.3QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicl…
CVE-2026-2270Medium· 5.9StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerabi…
CVE-2026-116810Medium· 5.3OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests …
CVE-2026-116745Medium· 6.5QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation
QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers …
CVE-2026-115804Medium· 6.4Consul vulnerable to an authorization bypass in health check registration
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability …
CVE-2026-116340Medium· 4.3iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization
A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of…
CVE-2026-115748High· 8.8Apache Vysper: Authorization bypass
**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any…
CVE-2026-97255Medium· 5.3WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: fr…
CVE-2026-96581High· 7.6An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Ac…
CVE-2026-114742Low· 2.7WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
CVE-2026-114741Low· 3.8WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
CVE-2026-116068High· 8.8Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like …