CVE-2026-53675

CVE-2026-53675 concerns BuddyPress 14.4.0, where an insecure direct object reference in the friends REST API allows any authenticated user to enumerate another user’s complete friend list. The get_items_permissions_check method only verifies that the requester is logged in, not ownership of the r...