CVE-2026-110763: Authorization Bypass Through User-Controlled Key

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

PT-2026-114132

Name of the Vulnerable Software and Affected Versions holaOS versions prior to 2026.822.2 Description An authorization bypass exists in the channel-gateway Telegram connector. The system authorizes senders using a mutable username instead of relying solely on the numeric id. An attacker can...

CVE-2026-110622: Missing Authorization

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip hasnodeperm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate,...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-70400): Gitea -- multiple vulnerabilities

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

PT-2026-114071

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded...

CVE-2026-110608: Authorization Bypass Through User-Controlled Key

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to...

CVE-2026-107158: Missing Authorization

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings...

CVE-2026-110465: Authorization Bypass Through User-Controlled Key

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student...

PT-2026-114139

Nexent through 2.7.0 contains a missing authorization vulnerability in check file access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storag...

CVE-2026-73126: Incorrect Authorization

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

CVE-2026-91156: Missing Authorization

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the...

CVE-2026-110615: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant,...

PT-2026-114136

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesControllercreate that allows family members to bypass account sharing permissions. Authenticated members with read only or no share can submit arbitrary entry ids to modify other members'...

CVE-2026-110611: Authorization Bypass Through User-Controlled Key

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or...

PT-2026-114155

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions prior to 2.42.0 Description An authorization bypass exists in the agent chat resume endpoint. The system accepts a run identifier from the request body without verifying if the suspended checkpoint...

CVE-2026-110768: Authentication Bypass by Spoofing

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

CVE-2026-110841: Authorization Bypass Through User-Controlled Key

n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent...

CVE-2026-91076: Missing Authorization

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers...

CVE-2026-103423: Missing Authorization

The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally...

CVE-2026-107417: Missing Authorization

Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through...