CVE-2026-104991

Phproject versions prior to 1.8.7 are affected by a missing object-level authorization vulnerability within the REST API issue endpoints, specifically single_get, single_comments, and single_comments_post. The root cause is the failure to invoke the allowAccess() authorization routine, allowing a...

EUVD-2026-91776

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Pangolin 교차 조직 리소스 인증 우회 CVE-2026-72001 에 대한 개념 증명PoC으로, Pangolin 1.22.0의 객체 수준 권한 부여broken-object-level-authorization 결함입니다. 이 취약점을 통해 하나의 리소스 공유 링크 를 보유한 공격자가 인스턴스의 다른 조직이 소유한 리소스를 포함한 모든 다른 리소스 에 대해 유효한 리소스 세션을 발급받을 수 있으며, 설정된 모든 인증 방식SSO, 리소스 비밀번호, PIN, 이메일 허용 목록, 헤더 인증을 우회합니...

CVE-2026-35045-PoC

CVE-2026-35045 — Tandoor Recipes의 객체 수준 권한 부여 우회Broken Object-Level Authorization 요약 Tandoor Recipes v2.6.1의 PUT /api/recipe/batchupdate/ 엔드포인트는 Space 내의 모든 인증된 사용자 가 해당 Space의 모든 레시피를 수정할 수 있도록 허용합니다. 여기에는 다른 사용자가 소유한 비공개 레시피도 포함됩니다. 이는 모든 표준 단일 레시피 엔드포인트에 적용되는 객체 수준 권한 부여 검사를 완전히 우회합니다. 근본 원인은...

CVE-2026-24134-PoC

CVE-2026-24134-PoC 개요 이 저장소는 StudioCMS의 CVE-2026-24134 , 즉 객체 수준 권한 부여BOLA 취약점에 대한 개념 증명PoC을 포함합니다. 내용 cve202624134poc.py - Python 공격 스크립트 사전 요구 사항 StudioCMS=0.1.1 pip install requests colorama 빠른 시작 수동 공격 기본 사용법 python3 cve202624134poc.py \ -u http://localhost:4321 \ --username visitoruser ...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392

In InvoicePlane version 1.7.2 , a missing object-level authorization check in the Users::form() function allows for a Primary Administrator Privilege Downgrade . A Secondary Administrator (user_type = 1, user_id != 1) can modify the Primary Administrator's (user_id = 1) user_type to 2, effectivel...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-96526

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-96526

The MCP Server for WordPress plugin for WordPress, in versions before 1.8.2 , is susceptible to an authorization vulnerability. The root cause is a lack of object-level authorization checks on one of its workflow REST routes (specifically workflows/run). This flaw allows users with the Contributo...

EUVD-2026-87538

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-96526: Exposure of Sensitive Information to an Unauthorized Actor

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-97060

X-SpringBoot versions through 6.0 are vulnerable to a broken object-level authorization flaw in user management endpoints. The root cause is a lack of ownership verification, allowing attackers with user-management permissions to perform unauthorized actions. Specifically, an attacker can reset p...

EUVD-2026-87254

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

CVE-2026-97898

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

EUVD-2026-86829

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-97898: Missing Authorization

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

PT-2026-99091

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software lacks object-level authorization in user management endpoints, which allows sub-administrators to modify or delete users without ownership verification. Attackers possessing...

PT-2026-98458

Name of the Vulnerable Software and Affected Versions Akia keyless entry cloud service affected versions not specified Description An Insecure Direct Object Reference IDOR exists due to missing object-level authorization. The unlock action relies on a client-supplied room or door identifier that...