EUVD-2026-88608

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...

CVE-2026-102373 GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks...

CVE-2026-79537

metatool-ai MetaMCP versions through 2.4.22 are vulnerable to an Insecure Direct Object Reference (IDOR) in the MCP transport session dispatch. The root cause is that the session store (getSession in session-lifetime-manager.ts) is keyed solely by the client-supplied mcp-session-id header without...

CVE-2026-79348

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

PT-2026-102820

Name of the Vulnerable Software and Affected Versions metatool-ai MetaMCP versions 2.4.22 and earlier Description An insecure direct object reference IDOR exists in the MCP transport session dispatch. The session store, specifically the getSession function in session-lifetime-manager.ts, relies...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

EUVD-2026-89362

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

CVE-2026-79537: Authorization Bypass Through User-Controlled Key

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

CVE-2026-79348: Authorization Bypass Through User-Controlled Key

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

PT-2026-102910

Name of the Vulnerable Software and Affected Versions KitchenAsty versions prior to 0.3.1 Description Broken object level authorization IDOR exists in the reservations API. The endpoint 'GET /api/reservations/:id' in packages/server uses authentication middleware but fails to perform ownership or...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

CVE-2026-79348

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

EUVD-2026-89425

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

CVE-2026-79348

KitchenAsty versions up to and including 0.3.0 is vulnerable to a broken object level authorization (IDOR) flaw in the reservations API. Specifically, the GET /api/reservations/:id endpoint in packages/server fails to perform ownership or role checks. The getReservation handler in packages/server...

CVE-2026-79348

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

GO-2026-6523 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy

Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy...

CVE-2026-101033

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation...

CVE-2026-101033 KitchenOwl through 0.7.10 IDOR via unchecked category ID

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation...

CVE-2026-101033

The KitchenOwl application (versions through 0.7.10 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the application fails to verify if provided category IDs belong to the caller's household during expense and item operations. This allows authenticated attac...