CVE-2026-106471 Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

CVE-2026-106471

A flaw in Candlepin involves broken object-level authorization within the central authorization filter. The system incorrectly grants access if any one of multiple @Verify-annotated parameters is accessible, rather than requiring access to every verified entity. A low-privilege authenticated atta...

CVE-2026-106471 Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Обход аутентификации при доступе к ресурсам между организациями в Pangolin Proof-of-concept для CVE-2026-72001 — уязвимости нарушенной авторизации на уровне объектов в Pangolin 1.22.0, которая позволяет владельцу одной share-ссылки на ресурс создать действительную сессию ресурса...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

CVE-2026-61596: Authorization Bypass Through User-Controlled Key

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-49464

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

CVE-2026-53639

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2026-85619

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

PT-2026-85562

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversation id/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85611: Authorization Bypass Through User-Controlled Key

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

CVE-2026-82023

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

CVE-2026-82023 LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

CVE-2026-82023 LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

EUVD-2026-70482

Helicone's VaultManager.getDecryptedProviderKeyById function in the GET /v1/vault/key/providerKeyId endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream...

CVE-2026-82023: Incorrect Authorization

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

EUVD-2026-69851

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...

PT-2026-84719

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-51956: Improper Access Control

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/id endpoint. The application does not enforce tenant-level...