PT-2026-83987

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update exchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without...

CVE-2026-51701

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84011

Name of the Vulnerable Software and Affected Versions Booking and Rental Manager versions prior to 2.7.7 Description Broken access control allows users with the subscriber role to perform unauthorized actions. Recommendations Update to a version newer than 2.7.6...

PT-2026-83840

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on com menus.item.id or core.admin. An authenticated us...

CVE-2026-78076: Improper Access Control

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...

PT-2026-83751

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description An issue exists where the software fails to validate if authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints. This allows any user...

CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

CVE-2026-81643

CVE-2026-81643 is a broken access control flaw in ash_graphql (versions 1.4.0 through 1.10.0 ). In AshGraphql.Subscription.Batcher, the should_send?/1 authorization filter is applied only to the first notification in a batch; remaining notifications are appended to outgoing results without that f...

CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

EEF-CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Summary Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops...

CVE-2026-82658

Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...

CVE-2026-82658 Admidio before 5.0.12 Broken Access Control via profile_function.php

Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...

CVE-2026-82658 Admidio before 5.0.12 Broken Access Control via profile_function.php

Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...

EUVD-2026-68244

Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...

CVE-2026-82658

Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...

CVE-2026-82658

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php . An authenticated low-privilege user can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID, disclosing that user's future rol...

CVE-2026-82658 Admidio before 5.0.12 Broken Access Control via profile_function.php

Admidio versions before 5.0.12 contain a broken access control vulnerability in profilefunction.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reloadfuturememberships endpoi...

CVE-2026-82633

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

EUVD-2026-68201

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...