CVE-2026-65013-BOLA-IDOR

CVE-2026-65013-BOLA-IDOR Reproducible PoC ofBOLA / IDOR in the tRPC API of Onlook CVE-2026-65013. Any authenticated user can read, modify, and delete projects, members, and AI history of other users just by passing their UUIDs to the tRPC procedures versions = 0.2.32. | ---|--- CVE| CVE-2026-6501...

Homarr < 1.54.0 - Information Disclosure

Homarr 1.54.0 contains an information disclosure caused by the integration.all tRPC endpoint being exposed as a publicProcedure, letting unauthenticated users retrieve sensitive integration metadata, exploit requires no authentication. id: CVE-2026-27796 info: name: Homarr 1.54.0 - Information...

CVE-2026-113596

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...

CVE-2026-113597

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder...

CVE-2026-113594

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...

CVE-2026-113597 Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder...

CVE-2026-113597 Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder...

CVE-2026-113597

Blinko versions through 1.8.8 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the tag tRPC router . This flaw allows authenticated users to access, read, and modify tags belonging to other users by providing arbitrary tag IDs. Specifically, an attacker can enumer...

CVE-2026-113597 Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder...

EUVD-2026-105163

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder...

CVE-2026-113596 Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...

CVE-2026-113596 Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...

CVE-2026-113596

Webstudio versions prior to 0.256.0 are vulnerable to an information disclosure flaw caused by missing authorization in the tRPC procedures publishedBuilds and findManyByIds. Authenticated users who possess another user's project UUID can query the /trpc handler to retrieve sensitive project data...

EUVD-2026-105162

Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...

CVE-2026-113595 Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...

CVE-2026-113595

Sharkord versions prior to 0.0.26 are vulnerable to a missing authorization flaw in the others.changeLogo tRPC mutation. This vulnerability allows any authenticated member to modify the server logo without possessing the required MANAGE_SETTINGS permission. An attacker can exploit this to remove ...

CVE-2026-113595 Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...

EUVD-2026-105161

Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGESETTINGS permission. Attackers can remove the current logo and replace it with an uploaded image that is...

EUVD-2026-105160

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...

CVE-2026-113594 Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGESETTINGS permission. Attackers can set a join password, disable registration, zero upload...