CVE-2026-124470 OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portalcustomreport.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other patient...

CVE-2026-124470 OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portalcustomreport.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other patient...

CVE-2026-124470 OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portalcustomreport.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other patient...

CVE-2026-124470

OpenEMR versions prior to 8.3.0 are vulnerable to a broken object level authorization (BOLA) vulnerability in portal/report/portal_custom_report.php. This flaw allows authenticated portal patients to access private problem list entries belonging to other patients by enumerating sequential IDs wit...

bola-CVE-2023-27524

bola-CVE-2023-27524 📄 README.md — BOLA CVE-2023-27524 Demo Project 🔐 Broken Object Level Authorization BOLA Demonstration CVE-2023-27524 Security Analysis & Fix --- 📌 Project Overview This project demonstrates a real-world Broken Object Level Authorization BOLA vulnerability and its secure...

CVE-2024-50633

CVE-2024-50633 🏆 - CVE-2024-50633 : Indico BOLA Vulnerability Discovered and reported a BOLA vulnerability in Indico. 📜 Description CVE-2024-50633 A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive user information by manipulating API...

CVE-2025-53640

CVE-2025-53640 – Authenticated User Enumeration in CERN's Indico BOLA Vulnerability PoC and technical analysis of CVE-2025-53640: a Broken Object Level Authorization BOLA vulnerability in Indico enables authenticated user enumeration via endpoint, exposing names, emails, and affiliations. Include...

CVE-2026-14871

CVE-2026-14871 - BOLA / IDOR in osTicket ajax.tickets.php Broken Object Level Authorization BOLA: Insecure Direct Object Reference IDOR include/ajax.tickets.php → viewField function Reported by @JF0x0r · March 27, 2026 Status: PATCHED - Fix released in osTicket v1.17.8 / v1.18.4 At a Glance Field...

CVE-2023-33730

CVE-2023-33730 — eScan Management Console Privilege Escalation Severity: Critical CVE ID: CVE-2023-33730 Disclosed: 30 May 2023 Author: Sahil Ojha Table of Contents Overview Vulnerability Details Impact Technical Analysis Proof of Concept Remediation References Disclaimer Overview eScan Managemen...

CVE-2026-24134-PoC

CVE-2026-24134-PoC Overview This repository contains the Proof of Concept PoC for CVE-2026-24134 , a Broken Object Level Authorization BOLA vulnerability in StudioCMS. Contents cve202624134poc.py - Python exploitation script Prerequisites StudioCMS=0.1.1 pip install requests colorama Quick Start...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 StudioCMS Privilege Escalation via Insecure API Token Generation NVD • Advisory • CWE-639 Overview The POST /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user at minimum Editor role to generate API tokens for any other user , including...

APIHarvester

ApiHarvester A full-pipeline black-box API security scanner written in Python. It enumerates endpoints, identifies parameters, probes HTTP methods, tests authentication/authorization logic, and runs standard OWASP API Top 10 attack simulations BOLA, Broken Auth, BFLA, Mass Assignment, Rate...

Cross-Evidence Authorization State Learning for Runtime Detection of Broken Object-Level Authorization in Black-Box Web Applications

Broken object-level authorization BOLA remains difficult to detect in black-box Web applications because external runtime monitors generally lack access to source code, authorization policies, and object-ownership records. This paper proposes a cross-evidence authorization-state learning method...

CVE-2026-65013-BOLA-IDOR

CVE-2026-65013-BOLA-IDOR Reproducible PoC ofBOLA / IDOR in the tRPC API of Onlook CVE-2026-65013. Any authenticated user can read, modify, and delete projects, members, and AI history of other users just by passing their UUIDs to the tRPC procedures versions = 0.2.32. | ---|--- CVE| CVE-2026-6501...

Phproject CVE-2026-104991 detect

Detects self-hosted Phproject = 1.8.6 REST issue API used in CVE-2026-104991 missing allowAccess on read/comment endpoints when security.restrictaccess is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Phproject issue tracker CVE-2026-104991 REST BOLA context.""" import re from...

Phproject CVE-2026-104991 REST issue IDOR

CVE-2026-104991 Phproject = 1.8.6: with security.restrictaccess enabled, GET /issues/@id.json, GET/POST /issues/@id/comments.json skip allowAccess while the web UI enforces ownership. Requires a low-privilege user API key and a confidential issue ID owned by another user. !/usr/bin/env python3 --...

CVE-2026-115994

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports...

CVE-2026-115994 BOLA Allows Cross-Project Target Tampering

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports...

CVE-2026-115994

The software Cervantes version v1.3-beta is affected by a Broken Object Level Authorization (BOLA) vulnerability (CWE-639). This flaw allows an attacker to modify or delete targets belonging to other projects without proper authorization. Such actions could compromise the integrity of penetration...

EUVD-2026-109260

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports...