EUVD-2026-55016

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

CVE-2026-15238

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

CVE-2026-67622

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-47185 Frappe Has Broken Access Control in its Workspace Save API

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...

CVE-2026-18277

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...

EUVD-2026-54092

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...

CVE-2026-18277

Technical details about CVE-2026-18277 are not publicly available in the provided documents. Monitor for updates from the vendor and CVE records.

CVE-2026-16734

The CVE concerns the Stripe Payment Forms by WP Full Pay WordPress plugin (before version 8.5.2). Two unauthenticated payment-form AJAX actions do not verify ownership of the referenced Stripe payment intent, enabling an unauthenticated visitor (with a page-embedded nonce) to alter the payment am...

CVE-2026-71251

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

EUVD-2026-53324

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2026-71251

CVE-2026-71251 (Akaunting) : The shared download route app/Http/Controllers/Common/Uploads.php::download() allowed an authenticated portal customer to fetch any Media by ID without verifying ownership. This constitutes a cross-company IDOR: a user could download another company’s uploaded files b...

CVE-2026-71242 Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy

Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify -hasCompany-companyid. Any authenticated user of one company can read, edit, or delete anothe...

CVE-2026-71242 Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy

Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify -hasCompany-companyid. Any authenticated user of one company can read, edit, or delete anothe...

CVE-2026-55739

CVE-2026-55739 (Crater) : The vulnerability arises from a missing tenant-ownership check in CustomerPolicy where view/update/delete do not verify company ownership, plus unscoped route-model lookups and bulk deletion (self::find($id)) that ignore company filters. As a result, any authenticated us...

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

CVE-2026-14848

The issue affects the Paid Membership Subscriptions WordPress plugin before version 3.0.8. The change-subscription checkout does not verify that the target subscription belongs to the current user, allowing any authenticated user with Subscriber-level access or higher to hijack another member’s s...

EUVD-2026-52173

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs...

CVE-2026-45330

Summary: The vulnerability in Decidim affects the verification admin flow where the pending_authorizations are loaded by raw identifiers without verifying current_organization ownership, allowing a tenant admin to view/approve/reject another tenant’s id_documents. The technical trigger is the use...