CVE-2026-125747

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

EUVD-2026-121229

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

EUVD-2026-120537

Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...

CVE-2026-125374

Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...

CVE-2026-125747: easysoft zentaopms: ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that…

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125374: krayin laravel-crm: Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and…

Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...

PT-2026-141743

ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated users to modify builds in projects they do not belong to. Attackers holding build privileges in any project can supply sequential buildID values to delete, edi...

CVE-2026-125374 Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detach

Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...

CVE-2026-125374 Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detach

Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...

CVE-2026-125374

Krayin CRM versions prior to 2.2.8 are susceptible to a broken object level authorization vulnerability (CWE-639) within the Lead TagController attach and detach actions. The root cause is that these actions skip necessary data-scope checks , allowing authenticated users restricted to specific in...

PT-2026-141197

Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...

CVE-2026-124473

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID sid belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to...

CVE-2026-124470

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portalcustomreport.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other patient...

EUVD-2026-119529

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID sid belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to...

CVE-2026-124473 OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID sid belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to...

EUVD-2026-119526

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portalcustomreport.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other patient...

PT-2026-139987

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID sid belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to...

PT-2026-139984

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal custom report.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other...

CVE-2026-124470: openemr: OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in…

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portalcustomreport.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other patient...

CVE-2026-124473: openemr: OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does…

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID sid belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to...