CVE-2025-13479

Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. QR Menu allows Exploitation of Trusted Identifiers. This issue affects QR Menu: through 21052026. NOTE: The vendor was contacted early about this disclosure but did not respond in any w...

CVE-2025-13479: Authorization Bypass Through User-Controlled Key

Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. QR Menu allows Exploitation of Trusted Identifiers. This issue affects QR Menu: through 21052026. NOTE: The vendor was contacted early about this disclosure but did not respond in any w...

PT-2026-42463

Name of the Vulnerable Software and Affected Versions QR Menu versions prior to 21052026 Description An authorization bypass exists due to a user-controlled key, which allows for the exploitation of trusted identifiers. This is an Insecure Direct Object Reference IDOR, a condition where an...

CVE-2026-6072 Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header

The Oliver POS – A WooCommerce Point of Sale POS plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/ REST API namespace through the oliverposrestauthentication...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the generateAccessToken path in...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the ability to bypass authentication by using a user-controlled key. This allows attackers to compromise the integrity of the protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab relates to bypassing authentication by using a key controlled by the user. Exploiting this vulnerability allows an attacker to remotely compromise the integrity of the protected information...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the ability to bypass authentication by using a user-controlled key. This allows unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab relates to bypassing authentication by using a key controlled by the user. Exploiting this vulnerability can allow an intruder, operating remotely, to gain unauthorized access to protected informatio...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the ability to bypass authentication by using a user-controlled key. This allows unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab relates to bypassing authentication by using a key controlled by the user. Exploiting this vulnerability can allow an intruder, operating remotely, to gain unauthorized access to protected informatio...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the ability to bypass authentication by using a user-controlled key. This allows attackers to compromise the integrity of the protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab relates to bypassing authentication by using a key controlled by the user. Exploiting this vulnerability allows an attacker to remotely compromise the integrity of the protected information...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the ability to bypass authentication by using a user-controlled key. This allows attackers to compromise the integrity of the protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab relates to bypassing authentication by using a key controlled by the user. Exploiting this vulnerability allows an attacker to remotely compromise the integrity of the protected information...

BIT-GITLAB-2026-6063 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user with developer-role permissions to remove code owner approval rules from merge request...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the getKnowledgeBaseForInitialization function. An attacker can gain unauthorized access to knowledge base data and potentially modify or disrupt information by manipulating the kbId...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the generic download endpoint when the disk and path parameters are supplied in the request. An attacker can access unrelated files stored on configured storage disks by manipulating...

Authorization Bypass Through User-Controlled Key

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the hasaccesstofile process. An attacker can permanently delete files owned by other users, as well as read or modify their contents, by leveraging access t...

Authorization Bypass Through User-Controlled Key

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the getfolders and processchatpayload paths in the folder and chat handling code. An attacker can read files and knowledge collections they do not have...

Authorization Bypass Through User-Controlled Key

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the retrieval process, specifically when validating access to knowledge base collections by UUID. An attacker can access, modify, or delete another user's...

Authorization Bypass Through User-Controlled Key

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the pinchannelmessage process. An attacker can modify the ispinned, pinnedby, and pinnedat fields of messages by sending API requests with only read-level...

Authorization Bypass Through User-Controlled Key

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the updatemessagebyid and deletemessagebyid handlers in channels.py. An attacker can overwrite or remove another member’s group or direct message conte...

Authorization Bypass Through User-Controlled Key

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the OAuth1 and OAuth2 credential reconnect endpoints. A user with readonly access to shared credentials can overwrite stored OAuth token material...

CVE-2025-15025

Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System allows Exploitation of Trusted Identifiers. This issue affects Library Automation System: from v.21.6 befor...