PT-2026-81117

Summary The Sakai REST API endpoint DELETE /api/users/userId/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId i...

CVE-2026-71507: Authorization Bypass Through User-Controlled Key

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-28190: Missing Authorization

Subscriber Broken Access Control in ProLancer Element = 1.4.8 versions...

CVE-2026-78258: Missing Authorization

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-78272: Missing Authorization

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

CVE-2026-27364: Missing Authorization

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

PT-2026-79797

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test func returns only request.user.is active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-21756: Incorrect Privilege Assignment

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments...

PT-2026-79841

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

PT-2026-80904

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

PT-2026-81059

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

CVE-2026-71505: Authorization Bypass Through User-Controlled Key

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

PT-2026-81054

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

CVE-2026-78259: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

CVE-2026-67204: Incorrect Authorization

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

CVE-2026-78291: Missing Authorization

Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...

CVE-2026-78266: Missing Authorization

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

CVE-2026-77116

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

EUVD-2026-64639

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...