EUVD-2026-91776

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991

Phproject versions prior to 1.8.7 are affected by a missing object-level authorization vulnerability within the REST API issue endpoints, specifically single_get, single_comments, and single_comments_post. The root cause is the failure to invoke the allowAccess() authorization routine, allowing a...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Обход аутентификации при доступе к ресурсам между организациями в Pangolin Proof-of-concept для CVE-2026-72001 — уязвимости нарушенной авторизации на уровне объектов в Pangolin 1.22.0, которая позволяет владельцу одной share-ссылки на ресурс создать действительную сессию ресурса...

CVE-2026-35045-PoC

CVE-2026-35045 — Нарушенная авторизация на уровне объектов в Tandoor Recipes Краткое описание Конечная точка PUT /api/recipe/batchupdate/ в Tandoor Recipes v2.6.1 позволяет любому аутентифицированному пользователю внутри Space изменять любой рецепт в этом Space — включая приватные рецепты,...

CVE-2026-24134-PoC

CVE-2026-24134-PoC Обзор Этот репозиторий содержит Proof of Concept PoC для CVE-2026-24134 — уязвимости Broken Object Level Authorization BOLA в StudioCMS. Содержимое cve202624134poc.py — скрипт эксплуатации на Python Предварительные требования StudioCMS=0.1.1 pip install requests colorama Быстры...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392

In InvoicePlane version 1.7.2 , a missing object-level authorization check in the Users::form() function allows for a Primary Administrator Privilege Downgrade . A Secondary Administrator (user_type = 1, user_id != 1) can modify the Primary Administrator's (user_id = 1) user_type to 2, effectivel...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-96526

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

EUVD-2026-87538

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-96526

The MCP Server for WordPress plugin for WordPress, in versions before 1.8.2 , is susceptible to an authorization vulnerability. The root cause is a lack of object-level authorization checks on one of its workflow REST routes (specifically workflows/run). This flaw allows users with the Contributo...

CVE-2026-97060

X-SpringBoot versions through 6.0 are vulnerable to a broken object-level authorization flaw in user management endpoints. The root cause is a lack of ownership verification, allowing attackers with user-management permissions to perform unauthorized actions. Specifically, an attacker can reset p...

EUVD-2026-87254

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

CVE-2026-97898

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

EUVD-2026-86829

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-97898: Missing Authorization

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

PT-2026-99091

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software lacks object-level authorization in user management endpoints, which allows sub-administrators to modify or delete users without ownership verification. Attackers possessing...

PT-2026-98458

Name of the Vulnerable Software and Affected Versions Akia keyless entry cloud service affected versions not specified Description An Insecure Direct Object Reference IDOR exists due to missing object-level authorization. The unlock action relies on a client-supplied room or door identifier that...

CVE-2026-76901 CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/id in PoolClueController.get and GET /pool/account/get/id in PoolCustomerController.get use bare pool-read permission checks without the CsPermission...