The Kirki – Freeform Page Builder plugin for WordPress up to version 6.3.2 contains an insecure direct object reference vulnerability via the 'context' parameter. This flaw allows unauthenticated attackers to access sensitive profile data of arbitrary users, including email addresses, display names, registration dates, profile image URLs, and various user meta fields. Exploitation requires a published page using a Kirki template with at least one user-type dynamic content block. User IDs can be enumerated through standard WordPress REST endpoints, making the attack feasible if such templates exist on the site.
CVE-2026-61726 is a high-severity improper access control vulnerability in Tandoor Recipes prior to version 2.6.12. It allows authenticated users with read and write API scope within a shared Space to read and modify private recipe steps belonging to other members of the same Space. The flaw arises because the application checks only Space membership rather than recipe-level ownership or sharing permissions when accessing certain API endpoints. This issue does not allow cross-Space access and is fixed in version 2.6.12.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10.
CVE-2026-59967 is an authorization bypass vulnerability in Tandoor Recipes prior to version 2.6.10. The flaw allows an authenticated member of a shared Space to access and delete another member's pending bookmarklet import by submitting the victim's bookmarklet identifier to the POST /api/recipe-from-source/ endpoint. This results in disclosure of private captured page content and destruction of the victim's pending import. The issue is fixed in version 2.6.10.
Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
FluentCart plugin for WordPress versions up to 1.7.0 contains an insecure direct object reference vulnerability. This flaw allows unauthenticated attackers to access other customers' billing and shipping address information by manipulating user-controlled keys in AJAX requests. The vulnerability arises from missing validation on order_id and address_id parameters, enabling enumeration of sequential IDs and bypassing intended access controls. The exposed data includes sensitive personally identifiable information (PII) such as street address, phone number, company name, and VAT number. The vulnerability has a high severity rating with a CVSS score of 7.5.
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress versions up to 5.2.1 contains an authorization bypass vulnerability via the 'password' parameter. Authenticated users with custom-level access or higher can exploit missing validation on a user-controlled key to change the WordPress password of any customer who has placed an order with the attacking vendor. This enables limited account takeover by logging in as that customer. Vendor-level access is required and can be self-registered if the public vendor registration option is enabled.
CVE-2026-105040 is a high-severity authorization bypass vulnerability in the EnergizeLab NestJS auth service version 1.8.2. It allows a registered user to manipulate the user ID in account update requests, enabling them to take over other user accounts by setting another account's identifier.
Temporal Technologies, Inc.'s temporal-proxy versions 0.2.0 through 0.8.0 have an authorization bypass vulnerability due to improper binding of encrypted payloads to namespaces. The proxy selects the decryption key based on an identifier in the payload rather than the request's namespace, allowing an authorized caller for one namespace to decrypt payloads from another namespace. This does not expose new encrypted payloads to attackers nor allow modification of ciphertext. The vulnerability has a medium severity score of 6.0 CVSS v4.0.
NL Portal Backend Libraries versions prior to 3.0.3 contain an improper authorization vulnerability. Authenticated users can access documents belonging to others via the getDocumentContent GraphQL query and a REST API endpoint without verifying ownership or authorization. Document identifiers are random but may leak, allowing unauthorized reading of potentially sensitive personal information. This issue is resolved in version 3.0.3.
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.
CVE-2026-110724 is a vulnerability in Eclipse Connected Services Platform's api-gateway component up to version 1.7.3. The default rate-limit key resolver uses the leftmost element of the X-Forwarded-For header to identify clients, but this header value is not validated against trusted proxies. This allows an attacker to bypass rate limiting by supplying unique header values, effectively obtaining unlimited independent rate-limit buckets.
CVE-2026-44084 is an authorization bypass vulnerability in QNAP Systems Inc. Video Station. It involves a user-controlled key that could allow remote attackers to access sensitive data without proper authorization. The issue has been fixed in Video Station version 5.8.8 and later.
The Blog2Social – Social Media Auto Post & Scheduler WordPress plugin versions up to and including 9.1.4 contain an authorization bypass vulnerability. Authenticated users with Contributor-level access or higher can exploit insecure direct object references in AJAX handlers to read titles and content of posts they do not own, including private and pending posts.
CVE-2026-102298 is a high-severity authorization bypass vulnerability in TP-Link Omada Software Controller (Windows) versions prior to 6.3.0.45. In MSP mode, the user-confirmation endpoint does not properly enforce permission checks, allowing authenticated users to supply a manipulated identifier parameter. This flaw enables user enumeration, credential verification, and unauthorized access to MSP resources or targeted accounts.
FileRise versions prior to 3.23.0 contain an improper access control vulnerability in the /api/folder/renameFolder.php endpoint. Authenticated users who are not folder-scoped administrators can move a folder they own into another user's folder or the root namespace without proper authorization checks on the destination. This allows rekeying of ownership and ACLs to the new location. The vulnerability does not allow overwriting existing files and reveals limited information about destination paths through error messages. The issue is fixed in version 3.23.0.
OpenAEV-Platform versions prior to 2.260622.0 have a missing authentication vulnerability in the /api/player/** lessons endpoints. These endpoints accept a userId query parameter without verifying the caller's identity or membership in the exercise. This allows unauthenticated attackers who know an exercise UUID to read sensitive lesson content and impersonate users by creating or overwriting answers. The issue is fixed in version 2.260622.0.
Plane, an open-source project management tool, prior to version 1.4.0, contains an authorization bypass vulnerability allowing members of one project to read description_html of public pages in other projects within the same workspace. This issue affects the PageVersionEndpoint, which scopes lookups by workspace and page but not by project_id, enabling unauthorized read access. The vulnerability is read-only and does not allow modification of pages. It is fixed in version 1.4.0.
Plane, an open-source project management tool, has an authorization bypass vulnerability in versions 1.3.1 and earlier. The public project asset endpoint /api/public/assets/v2/anchor/{anchor} allows authenticated users to perform write operations without verifying workspace or project membership. This enables unauthorized creation and soft-deletion of FileAsset records across projects, potentially causing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.
ServiceNext SerTec version 1.00 contains an authorization bypass vulnerability (CWE-639) in the /api/Usuario/GetUsuarios endpoint. The endpoint accepts a user-controlled numeric ID without verifying that the authenticated user is authorized to access the requested account. This allows any authenticated user to retrieve full profile records of other users, including passwords stored in cleartext (CWE-256). This vulnerability enables account takeover and credential-stuffing attacks.