EUVD-2026-68881

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

PT-2026-84000

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

CVE-2026-82878: Missing Authorization

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard...

PT-2026-83943

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2026-82651

SiYuan before v3.8.1 fails to apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. Although these routes require admin authentication , they construct file paths independently, allowing an authentica...

CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

Missing Authorization

Overview dolibarr/dolibarr is a modern and easy to use web software to manage your business. Affected versions of this package are vulnerable to Missing Authorization in the getGroups process of the REST API endpoint. An attacker can access group names, entity associations, and private notes of...

CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-82633

Dolibarr versions 10.0.0 through 23.x fail to perform per-object authorization checks in the Users::getGroups REST API endpoint (GET /users/{id}/groups). Any authenticated user can call this endpoint with arbitrary user identifiers to retrieve group memberships, entity associations, and private n...

CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-82633: Missing Authorization

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

PT-2026-83553

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-77007

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

EUVD-2026-68056

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom,...

CVE-2026-77007 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...

CVE-2026-18234

The MStore API WordPress plugin (versions before 4.21.1 ) contains a vulnerability where it fails to verify if the order targeted by its wallet payment handling belongs to the requester. Additionally, the plugin fails to deduct the wallet balance for most payment methods. This allows any authenti...

CVE-2026-19430

The Catfolders Document Gallery Pro WordPress plugin, in versions before 2.0.7 , contains an unauthenticated missing authorization vulnerability. The root cause is that certain REST API routes lack proper authorization, combined with a client-side forgeable token used to identify content. This al...