CWE-639
CVEs classified under CWE-639, newest first.
1439 CVEsRSS
CVE-2026-113655Medium· 4.3PoCApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
CVE-2026-92539Medium· 6.7Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only …
CVE-2026-113359Medium· 4.3Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to ret…
CVE-2026-113597Medium· 5.4Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures
Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequentia…
CVE-2026-113598Medium· 4.3Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm I…
CVE-2026-113600Medium· 5.4Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find w…
CVE-2026-113599Medium· 5.4Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/a…
CVE-2026-113596Low· 3.1Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's projec…
CVE-2026-113603Medium· 6.5x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid rout…
CVE-2026-113606High· 7.1PoCStirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a f…
CVE-2026-113610Medium· 5.4Xen Orchestra before 6.9.0 Authorization Bypass via user.set API
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. At…
CVE-2026-112240Medium· 6.3Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files…
CVE-2026-112068Medium· 5.3Insecure Direct Object Reference in extension "Analytics" (analytics)
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
CVE-2026-113349Medium· 4.3OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access…
CVE-2026-113353Medium· 5.4LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated ins…
CVE-2026-9589Critical· 9.3Unblu Spark Authorization Bypass in Configuration Cascade Operations
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and ch…
CVE-2026-77937High· 8.1PoCLetta through 0.16.8 Cross-Tenant Impersonation via user_id Header
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_S…
CVE-2026-77935High· 8.3PoCCoze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID …
CVE-2026-107366High· 8.3Langflow OSS Authorization Bypass Through User-Controlled Key
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hija…
CVE-2026-109431High· 8.1PoCCamunda Missing Authorization in Task Sub-Resources
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and atta…
CVE-2026-111939Medium· 4.6Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new …
CVE-2026-112287High· 7.1Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attack…
CVE-2026-112294Medium· 4.3FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered u…
CVE-2026-112286Medium· 6.5Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can que…
CVE-2026-110902Medium· 4.3WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a throu…
CVE-2026-94229Medium· 5.3TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal infor…
CVE-2026-112043Medium· 6.3PoCcalcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manip…
CVE-2026-110494Medium· 6.3Gitea release attachment re-linking of issue attachments
Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachmen…
CVE-2026-110383High· 7.5WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.…
CVE-2026-112004Low· 3.1PoCTeable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId en…