CVE-2026-84460 Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization...

CVE-2026-84460 Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization...

CVE-2026-81916 Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Expres...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability

Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

CVE-2026-77787 Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

CVE-2026-81817

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...