CVE-2026-89063

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversationid' parameter due to missing validation on a user controlled key. This makes it possible for...

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3. id: CVE-2024-33939 info: name: Masteriyo LMS = 1.7.3 - Insecure Direct Object Reference author:...

Danswer - Insecure Direct Object Reference

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/fileid interface to view any user's file. id: CVE-2024-9617 info: name: Danswer - Insecure Direct Object Reference author: s4e-io severity: medium...

CVE-2026-68530 Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

CVE-2026-54050

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

WordPress AI Engine plugin <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Sensitive Attachment Disclosure via 'mediaId' Parameter vulnerability discovered by Chi Trung Huynh - Duy Tan Universiy in WordPress Plugin AI Engine versions = 3.7.7...

PT-2026-90959

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables...

CVE-2026-11496 Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

PT-2026-86765

Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view. The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected sensitive fields such as: type key data fingerprint but did n...

CVE-2026-84836

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

CVE-2026-84769

Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...

EUVD-2026-70486

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...

WordPress WC Ukraine Shipping plugin <= 1.22.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin WC Ukraine Shipping versions = 1.22.5...

EUVD-2026-69847

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...

EUVD-2026-68407

ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in...

CVE-2026-81299

CVE-2026-81299 affects the WordPress WP Job Portal plugin, versions

EUVD-2026-67123

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...

CVE-2026-77768 OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

CVE-2026-77768

CVE-2026-77768 is an authorization bypass in OpenPanel , an open-source analytics platform. The report.get tRPC procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned the report directly via getReportById(), which performs a findUnique with no project scoping. The ...

GHSA-MPMW-F6H6-3G26 Winter: My Account preview exposes another backend user's profile by record ID

Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...