forgejo-keys-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · forgejo-keys-idor forgejo-keys-idor Class: IDOR Reach: Remote Forgejo 16.0.5 8d24b7d - Forgejo GET /api/v1/user/keys/id sits in the current-user group reqToken, user scope. The handler still loads publickey by numeric...

moodle-grades-feedback-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · moodle-grades-feedback-idor moodle-grades-feedback-idor Moodle LMS 5.2.3 - Moodle Class: IDOR Reach: Remote coregradesgetfeedback still only calls requirecapability'gradereport/grader:view'. Other grade web services...

CVE-2026-113599

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject...

Cve-2026-39676

Cve-2026-39676 Wordpress Version: Download Manager 3.3.5.2 Title: Missing Authorization - Unauthenticated IDOR Exploit...

CVE-2026-113600

Fat Free CRM before version 0.26.0 is vulnerable to an insecure direct object reference (IDOR) within the CommentsController . The root cause is the use of an unscoped Comment.find method in both the update and destroy actions without implementing proper authorization checks. This allows authenti...

CVE-2026-113599 Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject...

CVE-2026-113599

Modoboa versions before 2.8.0 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the API v2 armessages endpoint. This vulnerability allows authenticated users to create auto-reply messages for arbitrary mailboxes by providing another user's mbox value . An attacker can perform a...

EUVD-2026-105165

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject...

CVE-2026-113598

Modoboa versions before 2.8.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the POST /api/v2/alarms/bulk_delete/ action. This flaw allows authenticated users to delete monitoring alarms—including DNS, MX, and blocklist alerts—belonging to other domains by enume...

CVE-2026-113597 Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder...

CVE-2026-113597

Blinko versions through 1.8.8 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the tag tRPC router . This flaw allows authenticated users to access, read, and modify tags belonging to other users by providing arbitrary tag IDs. Specifically, an attacker can enumer...

CVE-2026-25197

CVE-2026-25197: Authorization Bypass via User-Controlled Key IDOR Advisory Field| Value ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639 Authorization Bypass Through User-Controlled Key Researcher|...

SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340: Insecure Direct Object Reference IDOR vulnerability in SOGo Webmail CVE ID: CVE-2025-50340 Reporter: Milad Seddigh Product: SOGo Affected Versions: v5.6.0 Impact: Insecure Direct Object Reference IDOR vulnerability → Allows the user to send emails on behalf of another user. Summar...

CVE-2017-11317-auto-exploit-

Vulnerabilities CVE-2017-11317 . https://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference...

CVE-2023-5808

CVE-2023-5808 CVE-2023-5808 is an Insecure Direct Object Reference IDOR in vulnerability found in Hitachi NAS' HNAS' System Management Unit SMU Backup & Restore functionality. This vulnerability affects SMU versions prior to 14.8.7825.01. Exploitation This exploit requires the attacker to have...

CVE-2026-112068 Insecure Direct Object Reference in extension "Analytics" (analytics)

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...

CVE-2026-112068

The typo3-ext-sa-2026-031 extension (specifically the Analytics module) contains an Insecure Direct Object Reference (IDOR) vulnerability. The backend module fails to verify if a backend user has authorized access to a requested site, allowing users with module access to view the analytics dashbo...

CVE-2026-55255-Lab

CVE-2026-55255 - Langflow IDOR in /api/v1/responses Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-55255, an Insecure Direct Object Reference IDOR vulnerability affecting Langflow's OpenAI-compatible Responses API. Langflow is an open-source...

CVE-2025-51859

CVE-2025-51859 Vulnerability description Chaindesk, a web application for constructing AI Agents, is vulnerable to Stored Cross-Site Scripting XSS in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the...

CVE-2026-12400-Exploit

CVE-2026-12400 — FlowForms IDOR: Unauthorized Form Modification Authenticated Contributor+ Insecure Direct Object Reference to Arbitrary Form Modification in FlowForms ≤ 1.1.1 Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2026-12400 CVSS Score| 4.3 — Medium CVSS Vector|...