By weakness (CWE)

CWE-639: related vulnerabilities

CVEs classified under CWE-639. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

193 published vulnerabilities · page 2 of 2

• CVE-2026-42999MEDIUM 6.0

  OpenStack Keystone contains a critical authorization bypass vulnerability that allows any authenticated user to escalate their privileges and access resources belonging to other users or projects. The vulnerability stems from a flaw in how Keystone processes policy enforcement—it blindly merges user-supplied JSON request data into the authorization check dictionary, overwriting the trusted database-sourced security context. This means an attacker can simply inject fake user IDs or project IDs into their API request to trick the system into granting them permissions they shouldn't have. The issue affects all versions before 29.0.2 and has existed since Rocky (14.0.0).

• CVE-2026-49858MEDIUM 5.9

  API Platform, a popular open-source framework for building REST and GraphQL APIs, has a security flaw in how it decides what data to show to different users. The vulnerability affects versions 2.6.0 through 4.1.28, 4.2.25, and 4.3.11. When an API endpoint is protected with access rules (defined via #[ApiProperty(security: ...)] annotations), those rules should prevent lower-privileged users from seeing certain sensitive fields. However, due to a caching mechanism that doesn't properly account for per-user security settings, a less-privileged user may see the structure and names of fields they shouldn't have access to—even though they can't read the actual values. This leaks information about what properties exist in your data model that the user wasn't meant to know about.

• CVE-2026-54590MEDIUM 5.9

  AsyncSSH, a Python library for SSH protocol implementation, contains a path traversal vulnerability in version 2.23.0 that allows attackers to read SSH authorized keys files from outside their intended directory. The vulnerability exists because the code blocks certain path traversal characters (/, comma, and double dots) before substitution, but fails to block tilde (~) and environment variable syntax (${ENV}), which are expanded later in the process. This allows an attacker with network access to potentially retrieve sensitive key data by crafting specially formatted authorized keys file paths. The issue has been patched in version 2.23.1.

• CVE-2026-57943MEDIUM 5.9

  LibrePhotos versions before 1.0.0 contain an authorization flaw that lets authenticated users view other people's private photos. The vulnerability exists in the SetPhotosShared endpoint, where the application fails to properly verify that only a photo's owner can change who it's shared with. An attacker with a valid LibrePhotos account can manipulate the sharing settings to grant themselves access to private photos belonging to any other user on the system, effectively reading arbitrary private image collections without permission.

• CVE-2026-58580MEDIUM 5.9

  LobeChat server deployments up to version 2.2.9 contain an authorization flaw that allows authenticated users to tamper with other users' message metadata. If an attacker learns another user's message ID, they can modify that user's plugin tool settings, error states, text-to-speech configurations, and translation records. The victim would then receive corrupted or attacker-controlled content when accessing their own messages. This is a localized instance attack—it affects users sharing the same LobeChat deployment.

• CVE-2026-13549MEDIUM 5.4

  CodeAstro Complaint Management System version 1.0 contains an authorization bypass vulnerability in its Report deletion functionality. An attacker can remotely trigger improper access controls in the deletereport function, allowing unauthorized deletion or modification of report data. The vulnerability requires user interaction (such as tricking an administrator into clicking a malicious link) but does not require authentication. Public exploit code is available, increasing the risk of opportunistic attacks.

• CVE-2026-14614MEDIUM 5.4

  Keycloak administrators with limited permissions can bypass access controls to modify hidden client scopes—settings that control what data and permissions get added to security tokens. By exploiting this flaw, a restricted admin could inject unauthorized permissions into tokens issued to end-users, potentially granting other applications unintended access. This affects Keycloak installations using the Fine-Grained Admin Permissions v2 feature.

• CVE-2026-24755MEDIUM 5.4

  Kiteworks, a platform for secure data sharing and management, contains a flaw in its Secure Data Forms feature that allows logged-in users to change permissions on files and folders belonging to other users. The vulnerability stems from the system not properly verifying whether a user actually owns or has authority over a resource before allowing permission changes. An attacker with valid credentials could exploit this to gain access to, or revoke access from, other users' sensitive data without authorization.

• CVE-2026-49192MEDIUM 5.4

  A flaw in the Acer Connect M6E 5G device's summary service endpoint allows authenticated users to bypass ownership checks and access device data they don't own. An attacker with valid credentials can enumerate and scrape hardware information by manipulating device serial numbers in API requests, leading to unauthorized disclosure of device details across the user base.

• CVE-2026-52779MEDIUM 5.4

  OpenProject versions before 17.3.3 and 17.4.1 contain a flaw that allows a project manager in one project to delete shared views (Calendar or Team Planner queries) from another project they shouldn't have access to. The vulnerability stems from the application checking permissions against the wrong project context, then loading the actual view without re-validating ownership. An attacker exploits this by leveraging their legitimate management role in one project to sabotage shared work views in a separate project, disrupting collaboration for other users.

• CVE-2026-5309MEDIUM 5.4

  GitLab EE contains an authorization bypass vulnerability affecting virtual registry cleanup policies. An authenticated user can read or modify cleanup policy settings for groups they do not own or have explicit access to. The flaw exists across multiple version lines and requires an authenticated attacker—no special privileges or user interaction is needed beyond login credentials.

• CVE-2026-56774MEDIUM 5.4

  Kanboard versions up to 1.2.52 contain a flaw that allows any logged-in user to forcibly log out other users, including administrators. The vulnerability stems from insufficient validation of session identifiers when processing remember-me cookie deletions. An attacker with valid credentials can systematically enumerate and invalidate persistent login tokens belonging to other accounts, disrupting operations and forcing legitimate users to re-authenticate. This is a classic privilege escalation scenario where ordinary user permissions are abused to cause service disruption at scale.

• CVE-2026-56823MEDIUM 5.4

  AutoGPT, a workflow automation platform for managing AI agents, contains an access control vulnerability in its webhook management feature. An authenticated user can request information about any webhook in the system by guessing or iterating through webhook IDs, discovering whether webhooks exist and what OAuth provider they use. In some cases, an attacker can also trigger webhook delivery events on behalf of another user. The vulnerability requires authentication but allows horizontal privilege escalation—a user with legitimate access can probe other users' integrations.

• CVE-2026-57646MEDIUM 5.4

  Majestic Support versions 1.1.7 and earlier contain an Insecure Direct Object References (IDOR) vulnerability affecting subscriber accounts. An authenticated user can manipulate request parameters to access or modify subscriber data belonging to other accounts without proper authorization checks. This is a classic object-level access control failure where the application trusts user-supplied identifiers without verifying ownership.

• CVE-2023-40200MEDIUM 5.3

  A WordPress plugin called WP Logo Showcase Responsive Slider and Carousel contains a flaw that allows attackers to bypass access controls by manipulating user-controlled parameters. An attacker can exploit this to perform unauthorized actions—specifically modifying content—without needing to authenticate or interact with a legitimate user. The vulnerability affects all versions through 3.6.

• CVE-2025-15657MEDIUM 5.3

  CVE-2025-15657 is a security flaw in School Management software (versions 93.1.0 and earlier) that allows unauthenticated attackers to view data they shouldn't have access to. The vulnerability stems from improper access controls on specific resources—an attacker can directly request or manipulate object identifiers in URLs or API calls to retrieve sensitive information without logging in. While the flaw enables unauthorized information disclosure, it does not permit modification of data or system unavailability.

• CVE-2026-10597MEDIUM 5.3

  OMICARD EDM, a product developed by ITPison, contains a vulnerability that allows attackers without credentials to access user email addresses by manipulating a specific parameter in a web request. No authentication is required, making this a direct and accessible attack surface. While the vulnerability does not allow attackers to modify data or disrupt service, the unauthorized disclosure of email addresses poses a clear privacy and information-gathering risk.

• CVE-2026-11896MEDIUM 5.3

  The My Calendar plugin for WordPress has a flaw that allows anyone on the internet to secretly peek at calendar events they shouldn't be able to see. By manipulating a web request parameter, an attacker can view the full details of non-public, draft, trashed, and personal calendar events—including titles, descriptions, dates, locations, and organizer information—without needing to log in or have permission. The vulnerability affects all versions up to 3.7.14 and stems from the plugin failing to properly validate user input before retrieving calendar data.

• CVE-2026-12418MEDIUM 5.3

  A vulnerability in the User Frontend WordPress plugin (versions up to 4.3.7) allows unauthenticated attackers to modify post content on vulnerable sites. By accessing any WPUF post submission form—which doesn't require a WordPress user account—attackers can overwrite titles, body text, and excerpts of arbitrary posts, including those created by administrators. The attack exploits inadequate permission checks in the plugin's AJAX submission handler.

• CVE-2026-12657MEDIUM 5.3

  The LatePoint calendar and appointment booking plugin for WordPress contains a flaw that allows anyone on the internet—even without logging in—to bypass restrictions on certain services. Specifically, attackers can create bookings for services that should only be available to administrators and staff, potentially filling up reserved appointment slots and creating unauthorized bookings in the system. The vulnerability exists because the plugin fails to properly validate which services a user is allowed to book.

• CVE-2026-13450MEDIUM 5.3

  The GamiPress gamification plugin for WordPress contains a flaw that lets anyone—without logging in—read private activity logs of any user on the site. These logs include badge earnings, point changes, and integration records from WooCommerce, LearnDash, and BuddyPress. The vulnerability exists because the plugin fails to validate who should access these records, and it broadcasts a security token to all website visitors, making the authentication nearly meaningless.

• CVE-2026-25782MEDIUM 5.3

  Gitea, a popular self-hosted Git service, has a flaw in how it validates permissions when users attempt to delete time-tracking entries. The vulnerability allows an attacker to delete time entries that belong to a different issue than the one being accessed, bypassing the expected scope restriction. This occurs in versions before 1.25.5 and requires no special privileges or user interaction to exploit.

• CVE-2026-46453MEDIUM 5.3

  Apache Camel's Elasticsearch REST client component has a critical configuration oversight that allows unauthenticated attackers to hijack Elasticsearch operations when the component is exposed via HTTP. The vulnerability stems from improperly named HTTP headers that bypass Camel's standard security filtering. An attacker can inject headers to read all documents, delete data, or extract sensitive information without any credentials. This affects multiple versions of Apache Camel and requires immediate patching or defensive workarounds.

• CVE-2026-46544MEDIUM 5.3

  Microsoft's UFO framework for intelligent automation has a session reuse vulnerability affecting version 3.0.1-4-ge2626659. When a client completes a task, the session remains in memory with its results. An authenticated attacker who knows a past session ID can submit a new task request reusing that ID, causing the server to return stale results from the previous session to the new requester. This is not a critical vulnerability but poses a confidentiality risk—the attacker must be authenticated and must guess or know a valid session ID, limiting real-world exploitability.

• CVE-2026-48206MEDIUM 5.3

  Apache Camel's JIRA integration allows unauthenticated attackers to manipulate JIRA operations by injecting HTTP headers. When a Camel route bridges incoming HTTP requests to a JIRA producer, attackers can inject headers that override the route's intended parameters—such as which issue to modify, which project to target, or what transition to apply—using the service account credentials configured in the endpoint. The vulnerability stems from Camel's header filtering logic, which was designed to block internal Camel-namespaced headers but inadvertently allowed plain header names (like 'IssueKey' and 'ProjectKey') to pass through from HTTP clients. This means an attacker can perform JIRA operations—deleting issues, changing their status, creating issues in unintended projects, modifying fields, managing watchers, or logging time—limited only by what the service account is permitted to do.

• CVE-2026-49099MEDIUM 5.3

  Apache Camel's Salesforce component has a vulnerability that allows attackers to hijack database queries and operations by injecting malicious headers through HTTP requests. When a route connects an HTTP endpoint to Salesforce, an unauthenticated attacker can override the intended SOQL queries, target objects, or API calls by setting specific HTTP headers. These operations execute with full permissions of the Salesforce integration user, potentially exposing sensitive data or performing unauthorized modifications. The issue stems from Camel's HTTP header filtering not recognizing Salesforce control headers as privileged, allowing them to pass through from untrusted external sources.

• CVE-2026-5348MEDIUM 5.3

  A flaw in the Academy LMS WordPress plugin allows anyone on the internet to view detailed course curriculum information without logging in or being enrolled. The vulnerability exists in the plugin's REST API for managing course topics, which was misconfigured to accept requests from unauthenticated users. An attacker can exploit this by cycling through course IDs to discover what lessons, modules, or other curriculum details exist in courses marked as private, draft, scheduled, or password-protected—information that should only be visible to enrolled students or instructors.

• CVE-2026-54105MEDIUM 5.3

  Two U.S. government systems used for federal contract disputes—the GAO's Electronic Protest Docketing System and the CBCA's Electronic Docketing System—leak user email addresses and account details through an unprotected API endpoint. An attacker can request information about any user account without logging in, simply by guessing or iterating user ID numbers. The systems fail to validate that a requester has permission to view account data belonging to someone else.

• CVE-2026-5459MEDIUM 5.3

  A WordPress plugin called User Frontend has a security flaw that allows anyone on the internet—without needing to log in—to change another user's subscription status. Specifically, an attacker can downgrade a paying customer to a free subscription tier, removing their paid features. The vulnerability exists in how the plugin handles subscription activation requests and fails to verify that the person making the request has permission to modify that user's account.

• CVE-2026-56781MEDIUM 5.3

  Teable, a database and collaboration platform, contains a flaw that allows anyone on the internet to read data fields that administrators intended to hide from public view. An attacker can discover which fields exist by examining metadata shared with them, then request those hidden fields by name when viewing shared records. The vulnerability affects Teable versions released before June 15, 2026, and requires no authentication or user interaction to exploit.

• CVE-2026-57630MEDIUM 5.3

  Blocksy Companion Pro versions up to 2.1.46 contain an Insecure Direct Object References (IDOR) vulnerability that allows attackers to access sensitive information without authentication. An attacker can bypass access controls by directly referencing object identifiers—such as user IDs or resource handles—and retrieve data they shouldn't have permission to view. This is a network-based attack requiring no special privileges or user interaction, making it straightforward to exploit.

• CVE-2026-57652MEDIUM 5.3

  JS Help Desk versions 3.1.0 and earlier contain an unauthenticated IDOR vulnerability that allows attackers to access sensitive information without logging in. An attacker can bypass authentication mechanisms and retrieve data they shouldn't have access to by manipulating object references in requests. This is a confidentiality risk but does not enable data modification or system disruption.

• CVE-2026-59817MEDIUM 5.3

  Ghost, a Node.js-based content management system, contains a vulnerability in its donation checkout feature that allows unauthenticated attackers to manipulate checkout metadata. By exploiting this flaw, attackers can obtain paid gift memberships at a fraction of their intended cost, effectively devaluing your membership revenue stream. The vulnerability affects versions 6.27.0 through 6.43.x and is resolved in version 6.44.0.

• CVE-2026-6802MEDIUM 5.3

  A WordPress plugin called Easy Upload Files During Checkout contains a security flaw that allows anyone on the internet to delete files from a site's media library without needing a password or any special access. The vulnerability exists in versions 3.0.1 and earlier. An attacker could exploit this to remove important images, documents, or other media, potentially disrupting site operations or destroying content.

• CVE-2026-7651MEDIUM 5.3

  A widely-used WordPress membership plugin contains a flaw that allows any logged-in user with basic subscriber privileges to delete media files (images, documents, etc.) that belong to other users, including administrators. The plugin fails to verify ownership before allowing deletion, meaning an attacker could systematically destroy important content without authorization. This affects all versions up to 5.1.5.

• CVE-2026-7665MEDIUM 5.3

  A WordPress plugin called Essential Addons for Elementor contains a flaw that allows anyone on the internet to view sensitive posts they shouldn't be able to see—including password-protected pages, private posts, and draft content. The vulnerability exists in a feature called 'ajax_load_more' that doesn't properly check permissions before returning post data. An attacker needs only a web browser; no login credentials or special interaction is required.

• CVE-2026-8839MEDIUM 5.3

  MapPress Maps for WordPress, a popular mapping plugin, contains a critical authorization flaw affecting all versions through 2.96.6. The plugin's REST API endpoints fail to verify whether the person making a request actually owns the map they're trying to access. This means unauthenticated attackers can read any map's sensitive details—locations, coordinates, addresses, and descriptions—simply by guessing map IDs, while legitimate WordPress users with contributor-level access or higher can modify, delete, or duplicate maps they don't own.

• CVE-2026-9180MEDIUM 5.3

  The MotoPress Appointment Booking plugin for WordPress contains a flaw that allows anyone on the internet to modify customer details in unconfirmed booking records without any authentication. An attacker can change the name, email, phone number, and internal customer ID associated with a booking that hasn't been confirmed yet. The vulnerability exists because the plugin's booking API endpoint accepts requests from anyone and doesn't verify that the person making the request actually owns the booking they're trying to modify. Attackers can discover target bookings by querying a publicly accessible list of appointments.

• CVE-2026-9188MEDIUM 5.3

  The Wappointment plugin for WordPress allows unauthenticated attackers to cancel or reschedule other users' appointments. The plugin generates authorization keys using a weak, predictable formula based on publicly observable or easily guessable information—a sequential customer ID, the appointment time, and staff ID—all hashed together without a random component. An attacker can recreate these keys and manipulate appointments belonging to other users if cancellation or rescheduling features are enabled on the site. This is a straightforward authorization bypass affecting all versions up to 2.7.6.

• CVE-2026-11500MEDIUM 5.0

  Weaviate versions up to 1.37.7 contain an authorization bypass vulnerability in the static API key authentication handler. An authenticated attacker can manipulate the StaticApiKey parameter to bypass access controls and gain unauthorized access to protected resources. The vulnerability requires a valid user account and significant technical knowledge to exploit, but public exploit code exists. Upgrading to version 1.38.0-rc.0 resolves the issue.

• CVE-2026-13534MEDIUM 5.0

  CherryHQ's cherry-studio application versions up to 1.9.7 contain an authorization bypass vulnerability in its CherryIN Preload API memory service. An authenticated attacker with local or remote access can manipulate a state parameter to bypass authorization controls and access unauthorized data or perform restricted actions. The vulnerability requires high technical complexity to exploit and is rated CVSS 5.0 (Medium). A public exploit exists, elevating practical risk for deployed instances.

• CVE-2026-27881MEDIUM 5.0

  Coolify, an open-source platform for managing servers and applications, contains an authorization flaw that allows any authenticated API user to view deployment information belonging to other teams. An attacker with valid API credentials can retrieve sensitive deployment details—such as configuration, status, and metadata—for deployments they should not have access to by simply guessing or enumerating valid deployment identifiers. The vulnerability exists in versions prior to 4.0.0-beta.464 and is resolved in that release.

• CVE-2026-27883MEDIUM 5.0

  Coolify is a deployment and infrastructure management platform, and versions before 4.0.0-beta.464 contain an authorization bypass in the deployment details API endpoint. Any user with valid credentials can view deployment information for teams they don't belong to, exposing sensitive infrastructure and application details across team boundaries. The flaw stems from the endpoint accepting a team identifier from the user's authentication token but failing to validate that the requested deployment actually belongs to that team.

• CVE-2026-34167MEDIUM 5.0

  Coolify, an open-source platform for managing servers and applications, contains an authorization flaw in its ActivityMonitor component. An authenticated user can view activity logs and command output from other teams by guessing sequential activity IDs. This could expose sensitive data like SSH credentials, database passwords, and infrastructure configuration details. The vulnerability affects all versions before 4.0.0-beta.471 and is fixed in that release.

• CVE-2026-42862MEDIUM 5.0

  Flowise, a popular drag-and-drop interface for building custom AI language model workflows, contains a security flaw that allows authenticated users to move tools between workspaces without proper authorization. When updating a tool, the application fails to validate who should have permission to change ownership fields like workspaceId. An attacker with legitimate access to one workspace can reassign tools to a different workspace, potentially exposing or stealing AI workflows, data pipelines, or proprietary configurations belonging to another team or customer. This breaks the isolation that multi-workspace Flowise deployments rely on to keep organizations separate.

• CVE-2026-59100MEDIUM 5.0

  LobeChat versions up to 2.2.9 suffer from a broken authorization flaw that allows authenticated users to view, modify, and delete chat agent data belonging to other users. By guessing or knowing other users' group identifiers, an attacker with valid login credentials can manipulate agent configurations in groups they don't own, effectively hijacking or disabling shared chat automation workflows without detection or consent.

• CVE-2026-59253MEDIUM 5.0

  n8n, a workflow automation platform, contains a flaw in how it checks permissions when users create or modify workflows. An authenticated user can craft specially-formatted requests to place workflows into folders belonging to other projects—even if they shouldn't have access to those projects. This is a logical integrity issue rather than a confidentiality breach; no data is exposed, but folder organization and project boundaries can be violated.

• CVE-2026-48783MEDIUM 4.8

  Postiz, an AI-powered social media scheduling platform, contained a security flaw in versions before 2.21.8 where an unauthenticated endpoint failed to validate the purpose of authentication tokens. An attacker could exploit this by using a signed token to trigger subscription-enforcement side effects within their own organization—such as disabling team members, removing integrations, or resetting scheduled posts—without needing to authenticate normally. The vulnerability is self-contained; attackers cannot use it to affect other organizations' accounts. The issue has been patched in version 2.21.8.

• CVE-2026-9799MEDIUM 4.6

  A vulnerability in Keycloak's User-Managed Access (UMA) system allows an authenticated user to bypass access controls by crafting a specific permission request. If a user has legitimate access to one resource via UMA, they can potentially manipulate their request to gain unauthorized access to all similar resources in the same resource server—even ones they should not have permission to access. This only happens in Keycloak instances configured with permissive policy enforcement mode on typed resources with owner-managed access enabled. The impact is limited to information disclosure or unauthorized modification, not system availability.

• CVE-2026-10023MEDIUM 4.3

  The Dokan multivendor marketplace plugin for WordPress contains a flaw that allows vendor-level users to manipulate orders they don't own. An authenticated vendor can change order statuses, inject fake notes and shipping tracking, or modify product download permissions on any marketplace order by reusing a valid security token from their own dashboard. This works because the plugin fails to verify that the vendor actually owns the order before performing the action.

• CVE-2026-10038MEDIUM 4.3

  The Charitable donation plugin for WordPress contains a flaw that allows authenticated users with basic subscriber permissions to delete any attachment from a site's Media Library. The vulnerability exploits a two-step process: attackers first poison the stored avatar metadata with a target attachment ID, then trigger normal avatar upload functionality to delete it. While this requires login access, the low privilege level needed and straightforward execution method make it a practical risk for any WordPress site running this plugin where subscriber-level registration is enabled.

• CVE-2026-10096MEDIUM 4.3

  The Qi Blocks WordPress plugin contains a flaw that allows authenticated users with author-level permissions to modify styling and appearance of posts, pages, and site-wide templates they don't own. An author could deface content, hide text, or alter the visual presentation of any page on a WordPress site without owning or having permission to edit that content. The vulnerability stems from the plugin failing to verify that a user actually owns the post before allowing style changes.

• CVE-2026-10154MEDIUM 4.3

  Dolibarr ERP CRM versions 23.0.0, 23.0.1, and 23.0.2 contain an authorization bypass vulnerability in the user messaging module. An authenticated attacker can manipulate the ID parameter in htdocs/user/messaging.php to access or view information they should not have permission to see. The vulnerability requires valid login credentials but allows a logged-in user to circumvent access controls. Upgrading to version 23.0.3 resolves the issue.

• CVE-2026-10623MEDIUM 4.3

  A WordPress plugin used for creating quizzes and exams has a flaw that lets teachers with higher access levels modify or delete quiz rules set up by other teachers without permission. The vulnerability requires someone to be logged into WordPress with instructor-level access or above, so it's not an external threat, but it does enable insider abuse or lateral privilege misuse within an educational institution using the plugin.

• CVE-2026-10780MEDIUM 4.3

  The Static Block plugin for WordPress has a flaw that allows authenticated contributors and higher-level users to read private and draft posts they shouldn't have access to. An attacker with a contributor account can craft a shortcode that retrieves any post by its ID and preview it, bypassing WordPress's normal permission checks. This affects all versions of the plugin through 2.2.

• CVE-2026-11900MEDIUM 4.3

  The Ad Inserter plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions to read private, draft, and password-protected content from other users' posts. An attacker can exploit this by inserting a specially crafted shortcode into a post they own, then previewing it to extract sensitive content. The vulnerability affects versions up to 2.8.16.

• CVE-2026-11987MEDIUM 4.3

  The Dokan WordPress plugin, which enables multi-vendor marketplaces similar to Amazon or Etsy, contains a flaw that lets any logged-in vendor see other vendors' product listings—including unpublished drafts and pending items. An attacker needs only a basic subscriber account and knowledge of another vendor's product ID to retrieve sensitive details like names, prices, and descriptions. The vulnerability stems from insufficient access controls: the plugin checks that a user has generic vendor permissions but fails to verify they actually own the product being accessed.

• CVE-2026-12433MEDIUM 4.3

  The Hydra Booking plugin for WordPress contains a flaw that allows hosts with elevated permissions to view booking details that don't belong to them. When a host requests booking information through the plugin's REST API, the system only checks that they have the right administrative role—not whether they actually manage that specific booking. An attacker with host-level access can guess or iterate booking IDs to access sensitive attendee information like names, emails, phone numbers, addresses, payment details, and internal notes from other hosts' bookings.

• CVE-2026-12904MEDIUM 4.3

  A WordPress plugin called Kadence Blocks contains a flaw that lets authenticated users with basic contributor permissions view or delete optimization analysis data they shouldn't have access to. The vulnerability stems from a mismatch: the plugin checks whether a user can edit a post based on one identifier, but then actually reads or deletes data based on a different, attacker-supplied file path. An attacker can exploit this by providing their own post ID (which passes permission checks) along with a victim's actual file path, gaining unauthorized access to that victim's optimizer records. This affects Kadence Blocks versions up to 3.7.7.

• CVE-2026-1291MEDIUM 4.3

  The Meow Gallery plugin for WordPress contains a flaw in its REST API that allows authenticated authors and above to modify gallery records without proper permission checks. An attacker with author-level credentials can create new gallery shortcodes or overwrite existing ones by directly specifying record IDs, potentially altering or injecting malicious gallery content into a WordPress site.

• CVE-2026-14209MEDIUM 4.3

  Keycloak's Admin UI has a permission-bypass flaw in its fine-grained access control system. An administrator restricted to searching for users—without permission to view their full profiles—can exploit a specific search endpoint to retrieve complete user details, including sensitive metadata. The system fails to enforce view-level permissions on this particular code path, creating an unauthorized information disclosure risk for privileged but constrained accounts.

• CVE-2026-14608MEDIUM 4.3

  A vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0 allows authenticated users to bypass authorization controls by manipulating an ID parameter in POST requests to /index.php?action=view_student. An attacker with valid login credentials can access student records they should not be permitted to view. The vulnerability has been publicly disclosed and exploit code may be available.

• CVE-2026-14793MEDIUM 4.3

  Craft CMS versions up to 4.18.0.1 contain an authorization bypass vulnerability in the global sets reordering functionality. An authenticated attacker can manipulate requests to the reorder-sets endpoint to perform actions they should not be authorized to perform. The vulnerability requires valid user credentials but does not require any special privileges or user interaction. Upgrading to version 4.18.1 eliminates the issue.

• CVE-2026-15036MEDIUM 4.3

  Harness versions up to 2.28.2 contain an authorization bypass vulnerability in the gitspaces endpoint that allows authenticated users to access workspace data they should not be able to see. An attacker with valid Harness credentials can manipulate requests to the getAuthorizedSpaces function to view information about spaces belonging to other users or teams. This is a remote attack requiring only network access and valid login credentials. Public exploit details are available, increasing the practical risk.

• CVE-2026-24756MEDIUM 4.3

  Kiteworks, a platform for secure data sharing and management, contains a flaw that allows authenticated users to modify data belonging to other users. The vulnerability stems from the application failing to properly verify that a user should have access to resources they're attempting to change. An attacker with valid credentials could exploit this to alter forms, templates, or other shared resources without authorization. The fix requires upgrading to version 9.3.0 or later.

• CVE-2026-27956MEDIUM 4.3

  Coolify, an open-source platform for managing servers and applications, contains a flaw that allows any authenticated user to discover domain names of applications controlled by other teams. When a specific optional parameter is added to a particular API call, the system fails to properly restrict access based on team membership, exposing this sensitive infrastructure information. The vulnerability affects versions before 4.0.0-beta.464 and is considered moderate in severity.

• CVE-2026-41160MEDIUM 4.3

  EspoCRM contains a logic flaw that allows lower-privileged users to pin notes they don't have permission to edit. The vulnerability stems from a timing issue in the API backend: the system modifies the note in the database before checking whether the user is actually authorized to do so. Even though the server returns an error message afterward, the damage is already done—the note remains pinned. This affects EspoCRM versions before 9.3.5.

• CVE-2026-44731MEDIUM 4.3

  OpenProject's meetings filter feature contains a user enumeration vulnerability that allows attackers with login credentials to discover which user accounts exist in the system and learn their full names. By testing different user IDs and analyzing how the application responds, an attacker can build a complete roster of valid accounts—information that's typically kept private. The vulnerability affects OpenProject versions before 17.3.2 and 17.4.0.

• CVE-2026-44732MEDIUM 4.3

  OpenProject, an open-source project management platform, contains an authorization bypass vulnerability in its document management functionality. An authenticated user can modify or move documents belonging to other projects even if they lack the necessary permissions, by exploiting a timing issue where attribute changes are applied before access controls are checked. The flaw affects versions prior to 17.3.2 and 17.4.0.

• CVE-2026-45563MEDIUM 4.3

  Roxy-WI, a popular web management interface for load balancers and web servers, contains a flaw that allows any logged-in user to view detailed audit trails of other users' administrative actions. Even a guest-level user in one department can see which servers another user has accessed, what configuration changes they deployed, and what services they restarted. The vulnerability affects Roxy-WI versions 8.2.6.4 and earlier. While this doesn't grant direct control over infrastructure, it exposes sensitive operational history that should remain confidential.

• CVE-2026-46764MEDIUM 4.3

  Apache Airflow contains an authorization bypass flaw in its audit-log API endpoints. An authenticated user with read access to audit logs for one workflow (Dag) can bypass per-Dag scoping restrictions and view audit-log entries from any other Dag in the same Airflow deployment by directly requesting specific event log IDs. The vulnerability stems from inconsistent permission enforcement: the collection endpoint properly restricts results by Dag, but the detail endpoint applies only a generic audit-log permission check without verifying the requester has access to the specific Dag whose logs are being retrieved. This allows low-privileged users to enumerate and read sensitive audit trails across Dags they should not be able to access.

• CVE-2026-49355MEDIUM 4.3

  OpenProject versions before 17.4.0 contain an information disclosure vulnerability in the meeting agenda API endpoint. An authenticated attacker can view private work package details that are linked to meeting agenda items, even when those work packages belong to projects the attacker cannot normally access. This leaks sensitive project information to users who should not have visibility into it.

• CVE-2026-5138MEDIUM 4.3

  Foreman, Red Hat's infrastructure management platform, contains a flaw that allows authenticated users with basic host-editing permissions to bypass authorization controls and view sensitive network configuration data from other organizations and locations. An attacker could extract subnet layouts, IP address ranges, gateway configurations, DNS server details, and VLAN assignments belonging to infrastructure they should not have access to. The vulnerability requires valid credentials and existing permissions to exploit, limiting its immediate blast radius, but it creates a significant cross-tenant data leakage risk in multi-tenant deployments.

• CVE-2026-53675MEDIUM 4.3

  BuddyPress 14.4.0 has a flaw in its friends REST API that allows any logged-in user to view another user's complete friend list without permission. The vulnerability exists because the API endpoint checks only that someone is authenticated, not whether they should have access to the specific friend list being requested. An attacker with any user account can enumerate and collect the private social connections of any other user on the platform.

• CVE-2026-54006MEDIUM 4.3

  Open WebUI, a self-hosted AI platform, contains an authorization bypass vulnerability in its calendar event management API. A regular user can create an event in their own calendar and then move it into another user's calendar without proper permission checks. While the initial event creation correctly validates authorization, the move operation skips this validation entirely. This allows any authenticated user to access or modify calendar events belonging to other users by knowing their calendar ID—a common identifier in multi-user deployments.

• CVE-2026-54016MEDIUM 4.3

  Open WebUI versions before 0.9.6 contain an authorization bypass in the search_knowledge_files function. When a model lacks attached knowledge bases but function calling is enabled, an authenticated user can query file metadata from any knowledge base by guessing or knowing its identifier, even if they should not have access. The vulnerability leaks file names and structural information about private or restricted knowledge bases, but does not allow file content extraction or modification.

• CVE-2026-56385MEDIUM 4.3

  Craft CMS contains a flaw that allows authenticated users with limited permissions to view preview data for assets they shouldn't have access to. An attacker with a low-privilege account can request a preview of restricted assets by manipulating the assetId parameter, receiving both preview HTML and a private image route that exposes the target asset. The vulnerability affects Craft CMS 5.0.0-RC1 through 5.9.13 and 4.0.0-RC1 through 4.17.7. Patch versions 5.9.14 and 4.17.8 resolve the issue.

• CVE-2026-56772MEDIUM 4.3

  NewsBlur, a self-hosted RSS reader and social platform, has a flaw in how it checks permissions on its social interaction endpoint. An authenticated user can request another user's notification feed—containing follows, replies, and activity—simply by guessing or enumerating user ID numbers. The application fails to verify that the requester owns or has permission to view that data. While an attacker needs a valid NewsBlur account, the barrier to accessing private social information is minimal once authenticated.

• CVE-2026-57676MEDIUM 4.3

  CVE-2026-57676 is an authorization bypass vulnerability in the Matteo Manna Simple User Avatar plugin affecting versions 4.9 and earlier. An authenticated attacker can manipulate user-controlled keys to circumvent access control checks and view sensitive information they should not have access to. The vulnerability requires login credentials but poses a real risk to any deployment where user privacy or data segregation is important.

• CVE-2026-57945MEDIUM 4.3

  PhotoPrism, a photo management application, has a flaw in how it validates user permissions when allowing authenticated users to modify profile information. An attacker who has logged-in access can change another user's profile details—such as their name, email, or other settings—by directly manipulating API requests. The vulnerability exists because the system doesn't properly verify that a user can only edit their own profile; it instead accepts modification requests for any user ID. This is not a critical flaw because it requires an attacker to already have legitimate account credentials, but it does allow unauthorized data tampering.

• CVE-2026-58653MEDIUM 4.3

  PraisonAI versions prior to 0.1.7 contain a cross-tenant data isolation flaw that allows authenticated users to create or modify issues within one workspace while secretly assigning them to projects in other workspaces. The vulnerability bypasses validation on the project_id parameter, enabling attackers to pollute project statistics and metrics across tenant boundaries without authorization. This is a privilege escalation and data integrity issue rather than a confidentiality breach, as the attacker cannot read data outside their workspace, only corrupt it.

• CVE-2026-8611MEDIUM 4.3

  A WordPress plugin called Klamra Paycal for Aspaclaria contains a flaw that allows authenticated users with subscriber-level permissions to access and download invoices belonging to other customers. The vulnerability stems from insufficient access controls on invoice retrieval—an attacker can simply modify an invoice identifier in a request to view sensitive billing data from any customer, including names, email addresses, phone numbers, order amounts, and internal notes. No special privileges or user interaction are required beyond basic authenticated access.

• CVE-2026-9228MEDIUM 4.3

  A WordPress plugin called Timetable and Event Schedule by MotoPress has a flaw that allows users with contributor-level access or higher to see confidential information they shouldn't have access to. Specifically, they can view drafts, pending reviews, and private event posts created by other users, including the content, excerpts, and author information. The vulnerability stems from the plugin failing to properly validate user input when retrieving event data, making it possible to directly access posts by guessing or enumerating their IDs.

• CVE-2026-9241MEDIUM 4.3

  The FOX – Currency Switcher Professional for WooCommerce plugin contains a flaw that lets authenticated users trick the system into thinking they have higher privileges than they actually do. By manipulating a request parameter, a subscriber-level user can impersonate a wholesale customer or administrator to access pricing they shouldn't be able to see. This only matters if your store uses the fixed user-role pricing feature and has set special prices for privileged customer types.

• CVE-2026-13490LOW 3.7

  A vulnerability in GLPI (Groupe Linux des Professionnels Informatiques), a popular open-source IT asset and helpdesk management system, allows an attacker to bypass authorization controls when viewing document files. By manipulating the document ID parameter in the document retrieval function, an unauthenticated attacker can potentially access files they should not be permitted to view. The issue affects versions 11.0.5, 11.0.6, and 11.0.7. While the attack is difficult to execute and requires specific conditions, it could expose sensitive documentation stored within GLPI instances.

• CVE-2026-24761LOW 3.7

  CVE-2026-24761 is an authorization flaw in Kiteworks Secure Data Forms that allows authenticated users to view metadata belonging to other users. Because the system doesn't properly verify who owns a resource before allowing access, a legitimate user can craft requests to retrieve information about files and documents they shouldn't see. The vulnerability requires an attacker to already have valid credentials and involves a higher complexity of exploitation, which limits its risk profile. This affects Kiteworks versions before 9.3.0.

• CVE-2026-6976LOW 3.7

  GitLab has patched a vulnerability affecting versions 15.9 through 19.0.1 that allowed authenticated developers to manipulate file names in merge requests, potentially hiding code changes from reviewers. The issue requires a developer-level account and specific interaction steps, making it a low-severity concern primarily relevant to organizations where code review integrity is a priority or where insider risk is elevated.

• CVE-2026-45159LOW 3.5

  Nextcloud's end-to-end encrypted file drop feature contained a logic flaw that allowed a user with drop-link access to place files into other encrypted folders owned by the share recipient—without being able to read or modify existing files. The vulnerability affects multiple version lines and has been patched across all active branches.

• CVE-2026-59215LOW 3.1

  Open WebUI versions before 0.10.0 contain a vulnerability that allows authenticated users to view thread conversations from other private channels or direct messages they shouldn't have access to. The flaw exists because the system doesn't properly verify that a message thread belongs to the channel being accessed—an attacker can reference a message ID from a different channel to read its context. This is a low-severity issue requiring authentication and specific conditions to exploit, but it does enable unauthorized information disclosure.

• CVE-2026-12102LOW 2.7

  A WordPress plugin called UsersWP has a flaw that allows editors and higher-level users to delete profile images (avatars and banners) belonging to any other user, including administrators. The vulnerability exists because the plugin doesn't properly validate which user a person is trying to modify when they submit a request to change or remove an image. While the impact is limited to image deletion and requires elevated account privileges to exploit, it could be used to deface user profiles or cause minor disruption.

• CVE-2026-45155LOW 2.6

  Nextcloud Server contains a flaw in its circles feature that allows authenticated users to add unknown circles to other circles by directly referencing their IDs, potentially enabling membership tracking. While circle IDs are designed with high complexity (62^15 combinations), if an attacker obtains a valid circle ID through other means, they could exploit this missing access control. The vulnerability requires an authenticated session and user interaction to exploit, making opportunistic attacks unlikely but targeted attacks possible if circle IDs are discovered.

• CVE-2026-47713LOW 2.0

  AnythingLLM versions before 1.13.0 contain a token persistence flaw that can leak sensitive data when administrators migrate from single-user to multi-user mode. A mobile device token issued in single-user mode may remain valid after the migration, allowing it to bypass user-scoping controls and access workspaces and chat content belonging to other users. The vulnerability requires an attacker to have had a legitimate mobile device token before the migration, then exploit it post-migration in the multi-user environment.

• CVE-2026-55611NONE 0.0

  AnythingLLM versions 1.11.1 through 1.14.0 contain an authorization flaw in the file embedding workflow. Authenticated managers or admins can delete parsed files belonging to other users across any workspace—including workspaces they have no membership in—by guessing or enumerating file IDs. The vulnerability exists because the delete operation bypasses ownership verification, executing even when the access control check fails. Version 1.14.1 fixes this issue.