EUVD-2026-74950

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...

CVE-2026-85611 OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

PT-2026-83232

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.24.6 through 2.3.x Description An authenticated user can destroy Kanban bucket assignments and task ordering of any project view across the entire instance. This occurs because the ProjectView.Delete function in...

CVE-2026-71507 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...