Authorization Bypass Through User-Controlled Key

Overview @n8n/instance-ai is an Instance AI is the agent runtime behind the AI assistant experience in n8n. It lets users ask for help with workflows, executions, credentials, nodes, and workflow building from inside an n8n instance. Affected versions of this package are vulnerable to Authorizati...

Authorization Bypass Through User-Controlled Key

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a mismatch between static validation and the runtime expression engine in external secrets handling. An attacker can access unauthorized...

Authorization Bypass Through User-Controlled Key

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a mismatch between static validation and the runtime expression engine in external secrets handling. An attacker can access unauthorized secret...

Authorization Bypass Through User-Controlled Key

Overview n8n-core is a Core functionality of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via a mismatch between static validation and the runtime expression engine in external secrets handling. An attacker can access unauthorized secret...

Authorization Bypass Through User-Controlled Key

Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the appointments/store and appointments/update endpoints. An...

Authorization Bypass Through User-Controlled Key

Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the oauthcallback process. An attacker can access and modify anoth...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the rate editing process for projects, customers, and activities. An attacker can modify billing-related rate configurations outside their authorized scope by combining an authorized...

pretix vulnerable to Authorization Bypass Through User-Controlled Key

When creating an export through the pretix API, API clients are returned an UUID value for their export job a long, random string like 35742818-c375-4d15-839f-d49aecce94d6. Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places...

PYSEC-2026-2960 pretix vulnerable to Authorization Bypass Through User-Controlled Key

When creating an export through the pretix API, API clients are returned an UUID value for their export job a long, random string like 35742818-c375-4d15-839f-d49aecce94d6. Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the shared channel inbound sync handler. An attacker can modify or delete posts belonging to other users by sending crafted synchronization messages that reference arbitrary post IDs i...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the shared channel inbound sync handler. An attacker can modify or delete posts belonging to other users by sending crafted synchronization messages that reference arbitrary post IDs i...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the incoming webhook process. An attacker can impersonate another user and create posts or direct messages attributed to them by crafting specific webhook configurations and payloads...

Authorization Bypass Through User-Controlled Key

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the incoming webhook process. An...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the incoming webhook process. An attacker can impersonate another user and create posts or direct messages attributed to them by crafting specific webhook configurations and payloads...

Authorization Bypass Through User-Controlled Key

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the incoming webhook process. An attacker can impersonate another user and create posts or...

CVE-2026-57694

Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through = 3.9.13...

EUVD-2026-43300

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization...

CVE-2026-61971 WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through = 2.6.3...

CVE-2026-61971 WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through = 2.6.3...

CVE-2026-61971

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through = 2.6.3...