PT-2026-109876

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the AiragExtDataController delete handler. Low-privileged authenticated users can delete AI evaluator or test-tracking records belonging to other users or tenants...

PT-2026-109895

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can delete department permission bindings due to missing authorization. An attacker can retrieve row identifiers from an unguarded list endpoint and provide them...

PT-2026-109917

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysTenantController within the GET '/sys/tenant/getTenantPackApplyUsers' endpoint. This issue allows any authenticated user to access tenant administrator...

PT-2026-109654

Name of the Vulnerable Software and Affected Versions Strapi versions 5.47.0 through 5.57.0 Description An improper authorization issue exists where admin API tokens maintain full access to Content Manager fields even after the owner's role has been restricted. This occurs because the...

PT-2026-109884

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysLogController. This issue allows any authenticated user, including those with low privileges, to delete system audit log entries. B...

PT-2026-109914

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryPageList handler of the OpenApiController. This allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can access the...

PT-2026-109920

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the listPackByTenantUserId handler within the SysTenantController. This issue allows authenticated users with low privileges to query tenant product packs by providi...

PT-2026-109915

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the OssFileController. Low-privileged authenticated users can access object storage file records by sending a request to the 'GET...

PT-2026-109896

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysDepartController within the GET '/sys/sysDepart/getDepartmentHead' endpoint. This issue allows any authenticated user to list department staff by enumerating...

PT-2026-109871

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the AigcWordTemplateController edit handler. This issue allows authenticated users with low privileges to modify word templates by sending PUT or POST requests to th...

CVE-2026-5727: Missing Authorization

The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-106609: Missing Authorization

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2...

PT-2026-109905

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the delete handler of the SysCategoryController. This issue allows any authenticated user to delete category dictionary nodes. Attackers with low privileges can...

PT-2026-109906

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysCategoryController that allows authenticated users to modify category dictionary nodes. By sending POST or PUT requests to the '/sys/category/edit' endpoint a...

CVE-2026-108165: Missing Authorization

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST...

CVE-2026-103357: Missing Authorization

Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3...

PT-2026-109916

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the queryById handler of the QuartzJobController. This allows authenticated users with low privileges to access scheduled job records by sending a request to the...

CVE-2026-108655: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron...

CVE-2026-108662: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

CVE-2026-108658: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full systenant records,...