lago-stripe-invoice-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · lago-stripe-invoice-idor lago-stripe-invoice-idor Lago v1.53.0 - GetLago POST /webhooks/stripe/:organizationid verifies Stripe-Signature with that URL org's webhook secret. Then the one-time branch in...

bitwarden-cipher-create-acl

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · bitwarden-cipher-create-acl bitwarden-cipher-create-acl Bitwarden Server v2026.9.2 - Bitwarden Org cipher create on the Entity Framework path MariaDB, Postgres, SQLite drops the caller id before collection attach. A...

forgejo-keys-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · forgejo-keys-idor forgejo-keys-idor Class: IDOR Reach: Remote Forgejo 16.0.5 8d24b7d - Forgejo GET /api/v1/user/keys/id sits in the current-user group reqToken, user scope. The handler still loads publickey by numeric...

CVE-2026-66750-Insufficient-Access-Controls-Allow-for-Unauthorized-File-Downloads-Let-s-Chat-

Security Advisory: Insufficient Access Controls Allow for Unauthorized File Downloads Let's Chat Assigned CVE ID: CVE-2026-66750 Summary GET /files/:id/:name checks that the caller is logged in and then serves the file. It never checks whether the caller is allowed to see the room the file belong...

Site Offline WP Plugin < 1.5.3 - Authorization Bypass

The plugin prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature. id: CVE-2022-1580 info: name: Site Offline WP Plugin 1.5.3 - Authorization Bypass author: s4e-io...

Branda WordPress plugin - Privilege Escalation

Branda WordPress plugin = 3.4.24 contains a privilege escalation caused by improper user identity validation in password update functionality, letting unauthenticated attackers change arbitrary user passwords, including administrators, exploit requires crafted request. id: CVE-2025-14998 info:...

openmeetings-invite-recording-acl

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-invite-recording-acl openmeetings-invite-recording-acl Class: IDOR Reach: Remote Apache OpenMeetings 9.1.0. CVE-2023-29032 stopped copying Wicket ADMIN into WebSession.rights. checkHashes still...

openmeetings-wb-fileid-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-wb-fileid-idor openmeetings-wb-fileid-idor Class: IDOR Reach: Remote Apache OpenMeetings 9.1.0. WHITEBOARD/PRESENTER CREATEOBJ stores client JSON including any fileId. RoomResourceReference then serves...

pfsense-api-acb-userkey

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-api-acb-userkey pfsense-api-acb-userkey Class: IDOR Reach: Remote pfSense Plus MIM API Netgate/pfsense-api b4acd7ca - Netgate GET /services/acb and GET /services/acb/bkp take userkey as an unconstrained query...

pfsense-api-fleet-jwt

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-api-fleet-jwt pfsense-api-fleet-jwt Class: IDOR Reach: Remote pfSense Plus MIM API Netgate pin b4acd7ca - github.com/Netgate/pfsense-api One POST /login Bearer is reused for every enrolled deviceid. Official...

EUVD-2026-101517

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

BIT-KIBANA-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...

BIT-ELASTICSEARCH-2026-103009 Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

CVE-2026-103009 Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

CVE-2026-72662 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...

CVE-2026-72662 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...

magento-instant-purchase-custom-price

abraxaslabs.tech · github.com/abraxas ·&...

Exploit for CVE-2026-52782

abraxaslabs.tech · github.com/abraxas ·&...

EUVD-2026-69554

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N 3.5 Low...

PT-2026-84399

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N 3.5 Low...