CVE-2026-109610

The Frappe ERPNext software versions prior to 15.119.1 and 16.x before 16.32.0 are vulnerable to a missing authorization flaw. The root cause is that certain endpoints fail to enforce proper permission checks, allowing authenticated low-privileged users to call these endpoints. Exploitation of th...

CVE-2026-109610 Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permit...

CVE-2026-109610 Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permit...

CVE-2026-109599 Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification

Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits...

CVE-2026-109599

Frappe versions before 15.113.3 and 16.x before 16.25.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper authorization checks, allowing authenticated users to send requests that modify records beyond the permissions of their assigned roles. No spe...

CVE-2026-109599 Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification

Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits...

CVE-2026-109568

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/link,story,chest,album/id with numeric IDs to overwrite or delete othe...

CVE-2026-109562

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...

CVE-2026-109564

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109377

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call getbatchqty, getbatchesbyoldest or getposreservedbatchqty to list every item...

CVE-2026-109568

The Shaark application, versions 1.2.13 through 1.2.44 , is vulnerable to a missing authorization flaw within the Link, Story, Chest, and Album API controllers. The root cause is a failure to perform ownership checks on these specific endpoints. Consequently, authenticated non-admin users can sub...

CVE-2026-109568 Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/link,story,chest,album/id with numeric IDs to overwrite or delete othe...

CVE-2026-109568 Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/link,story,chest,album/id with numeric IDs to overwrite or delete othe...

EUVD-2026-97891

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/link,story,chest,album/id with numeric IDs to overwrite or delete othe...

CVE-2026-109564 LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

EUVD-2026-97887

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109564

LearnHouse versions prior to 1.4.0 are susceptible to a missing authorization vulnerability (CWE-862) within the POST /api/v1/playgrounds/{uuid}/duplicate endpoint. The flaw occurs because this endpoint bypasses the read-access and draft checks typically enforced by get_playground. Consequently, ...

CVE-2026-109564 LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109562 SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...

CVE-2026-109562 SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...