CVE-2026-54050

Sakai (a Collaboration and Learning Environment) has an IDOR in its REST API: the DELETE /api/users/{userId}/profile/image endpoint in ProfileController.removeProfileImage() passes the attacker-controlled userId to the service layer without verifying ownership, allowing any authenticated user to ...

EUVD-2026-78246

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...

CVE-2026-90768

CAPEv2 (malware analysis platform) through commit 471ee4b fails to validate task ownership in its REST API task view and delete endpoints . An authenticated user can enumerate all tasks in the system and read or delete analyses submitted by other users, without any ownership verification. The CVS...

CVE-2026-90768 CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

CVE-2026-90768 CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

CVE-2026-90768 CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

CVE-2026-88912

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

EUVD-2026-76957

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

PT-2026-90796

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

CVE-2026-87797

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

CVE-2026-87797

The Sprout Invoices WordPress plugin (versions before 20.8.16 ) is vulnerable to a private note overwrite due to a missing capability or ownership check. An authenticated user, such as a subscriber , can exploit one of the plugin's AJAX actions (specifically si_edit_private_note) to overwrite pri...

EUVD-2026-76792

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...

EUVD-2026-76692

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

DEBIAN-CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

UBUNTU-CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

EUVD-2026-76606

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89257

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $REQUEST'id' to Category::deleteAssets, which...