CWE-639
CVEs classified under CWE-639, newest first.
1496 CVEsRSS
CVE-2026-111366High· 7.2PoCcool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can …
CVE-2026-111359High· 7.1PoCCRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in…
CVE-2026-111365Medium· 6.0PoCcool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissi…
CVE-2026-111358Medium· 5.4PoCSendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs
SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit se…
CVE-2026-111355Medium· 6.3zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization mod…
CVE-2026-111364Medium· 6.5MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any bo…
CVE-2026-111363Medium· 6.5PoCBISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate se…
CVE-2026-111354Low· 3.1PoCcrmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/fron…
CVE-2026-111351Medium· 4.2PoCmetasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks
metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, get…
CVE-2026-111348Medium· 5.4PoCLikeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with sel…
CVE-2026-111346Medium· 5.4PoCZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequentia…
CVE-2026-111345Medium· 4.3Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, w…
CVE-2026-111344Medium· 4.3PoCAPITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId
APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/descr…
CVE-2026-111331Medium· 6.3PoCDokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization…
Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization…
CVE-2026-111324Medium· 5.3PoCrustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname,…
CVE-2026-105040High· 8.8The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment)
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
CVE-2026-111169Low· 3.1La Suite Docs through 6.0.0 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access
La Suite Docs through 6.0.0 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request …
CVE-2026-108126Medium· 6.0temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for
temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by …
CVE-2026-103083Medium· 5.4Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectl…
Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectl…
CVE-2026-110381Medium· 6.3Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedu…
Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedu…
CVE-2026-61838High· 8.2PoCLychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). …
CVE-2026-46708Medium· 4.3EspoCRM is an open source customer relationship management application
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user c…
CVE-2026-77460Medium· 6.5EspoCRM is an open source customer relationship management application
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops…
CVE-2026-110724High· 7.5In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the orig…
CVE-2026-107416High· 7.5Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6…
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6…
CVE-2026-44084High· 7.5An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability …
CVE-2026-108092Medium· 4.3The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4
The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX h…
CVE-2026-54683Medium· 6.5PoCNL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/doc…
CVE-2026-110853High· 7.1n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier…
CVE-2026-110851Medium· 6.1n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent wit…
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent wit…