EUVD-2026-91776

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991

Phproject versions prior to 1.8.7 are affected by a missing object-level authorization vulnerability within the REST API issue endpoints, specifically single_get, single_comments, and single_comments_post. The root cause is the failure to invoke the allowAccess() authorization routine, allowing a...

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

CVE-2026-72001 — Pangolin 跨组织资源认证绕过 针对 CVE-2026-72001 的概念验证，这是 Pangolin（ 1.22.0）中的一个对象级授权失效漏洞，允许持有一个 资源 分享链接 的攻击者为实例上的任何其他资源（包括属于不同组织的资源）铸造有效的资源会话，从而绕过所有已配置的认证方式（SSO、资源密码、PIN、邮箱白名单、请求头认证）。 | ---|--- CVE| CVE-2026-72001 产品| fosrl/pangolin 受影响版本| 1.22.0 修复版本| 1.22.0 类别| 通过用户可控密钥的授权绕过 CWE-639 CVSS...

CVE-2026-35045-PoC

CVE-2026-35045 — Tandoor Recipes 中的对象级授权失效漏洞 摘要 Tandoor Recipes v2.6.1 中的 PUT /api/recipe/batchupdate/ 端点允许 Space 内的任何已认证用户 修改该 Space 中的任意食谱——包括其他用户拥有的私有食谱。这完全绕过了所有标准单食谱端点上强制执行的对象级授权检查。 根本原因是 Django REST Framework 的一个行为缺陷 ：detail=False 列表操作永远不会调用 hasobjectpermission，只会调用 haspermission。查询集仅通过...

CVE-2026-24134-PoC

CVE-2026-24134-PoC 概述 本仓库包含 CVE-2026-24134 的概念验证（PoC），这是 StudioCMS 中的一个对象级授权失效（BOLA）漏洞。 内容 cve202624134poc.py - Python 利用脚本 前置条件 StudioCMS=0.1.1 pip install requests colorama 快速开始 手动利用 基本用法 python3 cve202624134poc.py \ -u http://localhost:4321 \ --username visitoruser \ --password visitorpass ...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-100392

In InvoicePlane version 1.7.2 , a missing object-level authorization check in the Users::form() function allows for a Primary Administrator Privilege Downgrade . A Secondary Administrator (user_type = 1, user_id != 1) can modify the Primary Administrator's (user_id = 1) user_type to 2, effectivel...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-96526

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-96526

The MCP Server for WordPress plugin for WordPress, in versions before 1.8.2 , is susceptible to an authorization vulnerability. The root cause is a lack of object-level authorization checks on one of its workflow REST routes (specifically workflows/run). This flaw allows users with the Contributo...

EUVD-2026-87538

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-97060

X-SpringBoot versions through 6.0 are vulnerable to a broken object-level authorization flaw in user management endpoints. The root cause is a lack of ownership verification, allowing attackers with user-management permissions to perform unauthorized actions. Specifically, an attacker can reset p...

EUVD-2026-87254

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

CVE-2026-97898

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

EUVD-2026-86829

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-97898: Missing Authorization

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

PT-2026-99091

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software lacks object-level authorization in user management endpoints, which allows sub-administrators to modify or delete users without ownership verification. Attackers possessing...

PT-2026-98458

Name of the Vulnerable Software and Affected Versions Akia keyless entry cloud service affected versions not specified Description An Insecure Direct Object Reference IDOR exists due to missing object-level authorization. The unlock action relies on a client-supplied room or door identifier that...

CVE-2026-76901 CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/id in PoolClueController.get and GET /pool/account/get/id in PoolCustomerController.get use bare pool-read permission checks without the CsPermission...