CVE-2026-65709

CVE-2026-65709 concerns sysPass up to version 3.2.11, with a missing object-level authorization vulnerability in the JSON-RPC API. The issue allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access checks. ...

EUVD-2026-47745

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

CVE-2026-65013

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

PT-2026-63438

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

CVE-2026-16454

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...

CVE-2026-16454 Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...

CVE-2026-16454 Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...

PT-2026-61989

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...

CVE-2026-47130

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...

CVE-2026-47130

NextCRM contains a BOLA/IDOR in the PATCH /api/crm/contacts/[id] endpoint. Versions prior to 0.12.0 do not verify resource ownership, allowing any authenticated user (even with member role) to modify contacts/targets belonging to other users or organizations (cross-tenant data tampering). The iss...

CVE-2026-32821

CVE-2026-32821 affects dataCycle dataCycle-CORE prior to 26.06.08. An authenticated API user with a valid access token can use user_email to have the collection API evaluate permissions as another user, potentially exposing that user’s collections. In V4, if a collection id is known, the add_item...

CVE-2026-63099

TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing...

CVE-2026-63099 TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints

TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing...

CVE-2026-63099 TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints

TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing...

CVE-2026-63099

CVE-2026-63099 affects TheHive up to version 4.1.24 and describes a broken object‑level authorization in the attachment download endpoints. The vulnerability lets any authenticated user access attachments belonging to other organizations by supplying a content-hash identifier. The root cause is a...

PT-2026-60792

TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing...

PT-2026-60779

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...

PT-2026-59364

Summary Open WebUI has a Broken Object Level Authorization BOLA vulnerability in the builtin search knowledge files tool. When native function calling is enabled and the selected model has no attached knowledge bases, an authenticated user can call search knowledge files with an arbitrary knowled...

PT-2026-60033

Summary Three nutritional values action endpoints fetch objects via Model.objects.getpk=pk — a raw ORM call that bypasses the user-scoped queryset. Any authenticated user can read another user's private nutrition plan data, including caloric intake and full macro breakdown, by supplying an...

CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...