PT-2026-106325

Name of the Vulnerable Software and Affected Versions Faktur Pro for WooCommerce versions prior to 3.2.3 Description An authorization bypass exists due to incorrectly configured access control security levels. This allows for Insecure Direct Object References IDOR, a condition where an applicatio...

PT-2026-107143

An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...

CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-105761

The open-source LLM app development platform Dify contains an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.16.0 . The root cause is located in api/controllers/console/app/mcp_server.py, where the PUT /console/api/apps//server endpoint uses AppMCPServerController.pu...

CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-91107 openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password...

CVE-2026-91107

openSIS Classic 9.3 contains an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). An authenticated user with the built-in teacher role can manipulate the staff_id parameter to select an arbitrary staff record. Exploiting this flaw via the School Information update path allows the a...

CVE-2026-91107 openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password...

CVE-2026-91107 openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staffid and cause the School Information update path to reset that selected account's password...

CVE-2026-105692 Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator...

CVE-2026-105692

The open-source design and prototyping platform Penpot contains an IDOR vulnerability in its delete-share-link RPC before version 2.18.0 . The application fails to verify if a caller is the creator of a share-link or possesses administrator authority, checking only if the caller can edit the pare...

CVE-2026-105692 Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator...

CVE-2026-105692 Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator...

CVE-2026-105629

Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can permanently delete an estimate point...

CVE-2026-104975

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...

CVE-2026-14871

CVE-2026-14871 - BOLA / IDOR in osTicket ajax.tickets.php Autorizzazione a livello di oggetto non corretta BOLA: Riferimento diretto insicuro agli oggetti IDOR include/ajax.tickets.php → funzione viewField Segnalata da @JF0x0r · 27 marzo 2026 Stato: CORRETTO - Fix rilasciato in osTicket v1.17.8 /...

CVE-2026-97070 WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23...

CVE-2026-97070 WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23...

CVE-2026-97305 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...