PT-2026-97443

Name of the Vulnerable Software and Affected Versions SiteSkite versions prior to 2.1.8 Description An Insecure Direct Object Reference IDOR exists within the contributor functionality. IDOR is a type of access control flaw that occurs when an application provides direct access to objects based o...

PT-2026-97344

Name of the Vulnerable Software and Affected Versions WEBCON BPS versions prior to 2025.2.1.177 WEBCON BPS versions prior to 2026.1.1.20 Description An Insecure Direct Object Reference IDOR exists in the '/api/vacations/path' endpoint. The Gantt vacation chart API fails to validate if the...

CVE-2026-95592: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Team = 6.0.0 versions...

CVE-2026-93513: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in SiteSkite = 2.1.7 versions...

CVE-2026-90899: Exposure of Sensitive Information to an Unauthorized Actor

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...

CVE-2026-92419: Authorization Bypass Through User-Controlled Key

WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...

PT-2026-97486

Unauthenticated Insecure Direct Object References IDOR in Team = 6.0.0 versions...

PT-2026-97511

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description An Insecure Direct Object Reference IDOR allows unauthenticated users to expose Personally Identifiable Information PII. The 'checkout.searchGuestUser' endpoint permits querying guest checkou...

CVE-2026-93623: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in AI Engine = 3.7.8 versions...

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Summary The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — currentstore.carts.whereuser: nil, currentuser.findbyprefixid!params:id — and omits the...

GHSA-4825-P4XM-PCF2 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Summary The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — currentstore.carts.whereuser: nil, currentuser.findbyprefixid!params:id — and omits the...

GHSA-72H8-WP98-7HCH Unleash: Missing await on permission check + cross-project IDOR in admin API

Summary Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check. Vulnerability 1: Missing await on Permission Check HIGH File: src/lib/features/segment/segment-controller.ts line 345 POST...

Unleash: Missing await on permission check + cross-project IDOR in admin API

Summary Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check. Vulnerability 1: Missing await on Permission Check HIGH File: src/lib/features/segment/segment-controller.ts line 345 POST...

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

EUVD-2026-84867

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

CVE-2026-77426

The Unleash feature management platform (versions prior to 8.0.3 ) contains five authorization vulnerabilities in its admin API. A critical flaw in src/lib/features/segment/segment-controller.ts fails to await the hasPermission() call, allowing authenticated users to bypass permission checks and ...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...