CWE-639
CVEs classified under CWE-639, newest first.
1496 CVEsRSS
GHSA-7vfx-4246-jcfhHighSolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings
SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings
GHSA-q6xx-5vr8-p898Critical· 9.9Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
CVE-2026-49339High· 7.1gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists
gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists
CVE-2026-49338High· 7.1Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
GHSA-gfv4-4vr2-rr4gMedium· 4.6Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass
Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass
CVE-2026-56784High· 8.1PoCOpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary…
OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary…
CVE-2025-64105NoneFOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses
FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses. Versions 0.6.21 through 0.7.2 are vulnerable to IDOR through the support ticket creation workflow.…
CVE-2025-62180NonePega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.
Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.
GHSA-vjr9-f93j-mjr7High· 8.1Duplicate Advisory: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
Duplicate Advisory: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
CVE-2026-52812HighGogs: LFS dedupe path leaks private repo content across tenants
Gogs: LFS dedupe path leaks private repo content across tenants
CVE-2026-54518Medium· 6.5jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass (CVE-2026-54518)
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass security view restrictions by sending specially crafted JSON (JavaScript Object Notation) data. The UnwrappedPropertyHandler component, which proce…
CVE-2026-55255High· 8.4CISA KEVPoCLangflow is a tool for building and deploying AI-powered agents and workflows
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow be…
CVE-2026-6062Medium· 6.4Mattermost doesn't validate channel ownership of an existing subscription before applying edits
Mattermost doesn't validate channel ownership of an existing subscription before applying edits
CVE-2026-52799High· 7.5Gogs Missing Authorization in Attachment Download
Gogs Missing Authorization in Attachment Download
CVE-2026-56120Critical· 9.6OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
CVE-2026-53726Mediumparse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
GHSA-x26h-xmv8-gxf7Highstigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)
stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)
GHSA-xhv3-q4xx-349rHighstistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)
stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)
GHSA-h3m5-97jq-qjrfCritical· 9.6OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
CVE-2026-53863MediumOpenClaw: Tool group policy callers could accept unvalidated group IDs
OpenClaw: Tool group policy callers could accept unvalidated group IDs
CVE-2026-55670LowZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
GHSA-2fjj-qqg8-fg7xMedium· 4.3praisonai-platform: Authorization Bypass Through User-Controlled Key
praisonai-platform: Authorization Bypass Through User-Controlled Key
GHSA-hjwc-26pj-v3pmHighAgenticMail: Cross-agent task authorization bypass in AgenticMail API
AgenticMail: Cross-agent task authorization bypass in AgenticMail API
CVE-2025-15657Medium· 5.3Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.
Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.
CVE-2026-55198Medium· 6.5PoCHermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails …
CVE-2026-55197Medium· 6.5PoCHermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by direc…
CVE-2026-54006Medium· 4.3Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar
Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar
CVE-2026-54009Medium· 6.5Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
CVE-2026-54010High· 8.3Open WebUI: Forged chat-file link allows cross-user file read and deletion
Open WebUI: Forged chat-file link allows cross-user file read and deletion
CVE-2026-54015Medium· 6.4Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion