CVE-2026-110621

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

CVE-2026-110621 Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

CVE-2026-110621 Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

CVE-2026-110621

Swetrix Cloud versions prior to 5.1.0 are affected by a missing authorization vulnerability in the ProjectController.addProject function. This flaw allows authenticated users to hijack arbitrary projects by moving them into their own organization using a public tracking ID. Successful exploitatio...

EUVD-2026-101249

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

CVE-2026-110621 Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...

CVE-2026-110620 Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization...

CVE-2026-110620 Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization...

EUVD-2026-101248

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization...

CVE-2026-110620

Versions of Formbricks prior to 4.9.0 are vulnerable to a Cross-Organization IDOR (Insecure Direct Object Reference) flaw. The root cause is an authorization bypass where server actions, such as resetSurveyAction and updateSegmentAction, fail to verify if the provided organizationId owns the targ...

CVE-2026-110620 Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization...

CVE-2026-110620

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization...

CVE-2026-110617 we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mpid and guessable...

EUVD-2026-101245

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mpid and guessable...

CVE-2026-110617 we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mpid and guessable...

CVE-2026-110617

The software we-mp-rss (versions through 1.5.3 ) is vulnerable to a missing authorization issue in the /api/v1/wx/tools/export/download endpoint. The vulnerability exists because the authentication dependency is commented out, allowing unauthenticated attackers to download export archives from th...

CVE-2026-110617

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mpid and guessable...

EUVD-2026-101243

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant,...

CVE-2026-110615 jshERP through 3.6 Missing Authorization via /user/batchSetStatus

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant,...

CVE-2026-110615

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant,...