CVE-2024-37010

CVE-2024-37010 CVE-2024-37010 익스플로잇: 다른 사용자의 외부 저장소 접근 및 측면 이동: https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0753/ https://owncloud.com/security-advisories/insecure-direct-object-reference-in-external-storage 소개 Owncloud는 서버를 Google Drive와 같은 파일 저장용 클라우드로 전환합니다. 이를 통해 기업은 예를 들어 제3자가 관리하지 않는...

CVE-2026-92469

CVE-2026-92469 affects zlt2000 microservices-platform through 6.0.0 , specifically the file-center module . The DELETE /files/{id} endpoint performs no ownership validation, allowing any authenticated attacker to enumerate file identifiers via GET /files and subsequently delete other users' files...

CVE-2026-88910

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers...

CVE-2026-74926

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

CVE-2026-54050

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

EUVD-2026-78875

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

CVE-2026-54050

Sakai (a Collaboration and Learning Environment) has an IDOR in its REST API: the DELETE /api/users/{userId}/profile/image endpoint in ProfileController.removeProfileImage() passes the attacker-controlled userId to the service layer without verifying ownership, allowing any authenticated user to ...

CVE-2026-54050 Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

EUVD-2026-78282

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

EUVD-2026-78246

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...

PT-2026-91867

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netpoll: A race condition in netpollowneractive has been fixed. KCSAN detected a race condition in netpoll: - BUG: KCSAN: A data race occurs in netrxaction/netpollsendskb. A write operation marked as 0xffff8881164168b0, 4 bytes i...

CVE-2026-90768

CAPEv2 (malware analysis platform) through commit 471ee4b fails to validate task ownership in its REST API task view and delete endpoints . An authenticated user can enumerate all tasks in the system and read or delete analyses submitted by other users, without any ownership verification. The CVS...

CVE-2026-90768 CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

CVE-2026-88912

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

EUVD-2026-76957

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

CVE-2026-87797

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

CVE-2026-87797

The Sprout Invoices WordPress plugin before 20.8.16 has a missing authorization check on the si_edit_private_note AJAX action. Because no capability or ownership verification is performed, any authenticated user with the subscriber role (or higher) can overwrite private notes belonging to other u...

EUVD-2026-76792

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...