CVE-2026-65696

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can...

EUVD-2026-47621

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

CVE-2026-2406

An authorization bypass in Universe Software's Online Registration and Workflow Management System (through 12022026) is reported as CVE-2026-2406. The vulnerability stems from a user-controlled key, enabling unauthorized access. CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; base score 6....

CVE-2026-2406

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

EUVD-2026-47585

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

PT-2026-63332

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

CVE-2026-63259

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

CVE-2026-63259 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

CVE-2026-63259

CVE-2026-63259 affects Kibana and involves an Authorization Bypass via a user-controlled key, enabling potential information disclosure by referencing scheduled query result data in Kibana Spaces to which the requester lacks access. The CVSS 3.1 base score is 4.3 (Medium) with NETWORK attack vect...

CVE-2026-63259

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

Kibana 9.4.4 Security Update (ESA-2026-70)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the...

CVE-2026-56147

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

CVE-2026-56147 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

CVE-2026-56147

CVE-2026-56147 describes an Authorization Bypass in Kibana where a low-privileged authenticated user can bypass file access controls due to a mismatch between access checks and resource retrieval. The vulnerability enables unauthorized retrieval, modification, or deletion of case attachments (inc...

Kibana 8.19.18, 9.3.7, 9.4.3 Security Update (ESA-2026-59)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity...

PT-2026-62095

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse CAPEC-122. An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to...

PT-2026-63264

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the views.py process of the Dashboard Module. An attacker can gain unauthorized access to restricted dashboard functionalities by sending crafted requests to endpoints without proper...

CVE-2026-11763

Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows Exploitation of Trusted Identifiers. This issue affects GisLab Laboratory Management System: from 1.4.03...

CVE-2026-12693

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...