CVE-2026-109393: Authorization Bypass Through User-Controlled Key

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htlaccess hotel checks. Hotel-restricted employees can supply other...

CVE-2026-108854

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across...

CVE-2026-108853

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assista...

CVE-2026-108864 iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...

CVE-2026-108864

The iFlytek Astron Agent (through version 1.1.2 ) is vulnerable to an insecure direct object reference (IDOR) in the POST /workflow/v1/resume endpoint. This flaw allows authenticated applications to resume paused workflows belonging to other applications by supplying a predictable Snowflake event...

EUVD-2026-97005

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across...

EUVD-2026-97004

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assista...

EUVD-2026-96580

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded...

EUVD-2026-96546

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked G...

EUVD-2026-96548

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech...

EUVD-2026-96547

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET...

CVE-2026-108864: Authorization Bypass Through User-Controlled Key

iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their eventid to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume...

CVE-2026-108862: Authorization Bypass Through User-Controlled Key

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query...

CVE-2026-108854: Authorization Bypass Through User-Controlled Key

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across...

PT-2026-110173

Name of the Vulnerable Software and Affected Versions Wanwu versions prior to 0.6.3 Description An insecure direct object reference issue allows authenticated enabled users to delete legacy AppKeys belonging to other users. This is achieved by providing a numeric apiId to the DELETE...

PT-2026-110172

🚨 CVE-2026-108853 UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed...

CVE-2026-108853: Authorization Bypass Through User-Controlled Key

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assista...

CVE-2026-108608

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET...

CVE-2026-108164

Open Source Social Network OSSN through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossncom.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/guid route with sequentia...

EUVD-2026-96319

Open Source Social Network OSSN through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossncom.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/guid route with sequentia...