OpenList versions prior to 4.2.4 contain a vulnerability in the search API where a non-separator-aware prefix check allows unauthorized users to access metadata or file-existence information of sibling paths. This occurs because the strings.HasPrefix function is used improperly for path containment authorization, leading to exposure of sensitive information. The issue is fixed in version 4.2.4.
Temporal Server versions 1.30.0 through 1.30.7, 1.31.0 through 1.31.3, and 1.32.0 are affected by an authorization bypass vulnerability in Scheduler V2. An authenticated user with write permission in one namespace can manipulate schedule state in another namespace by exploiting internal completion callbacks that are not properly bound to namespaces. This can cause schedules to incorrectly record actions as completed or pause schedules improperly. No workflow payload or history disclosure is involved. Scheduler V2 is off by default, and only namespaces with Scheduler V2 schedules are vulnerable.
### Impact
Tool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, **any valid token could read, write, or delete any configured vault** by passing `input.vault`, defeating multi-tenant isolation across ~90 tool sites. (`resources/read` was the only surface that already guarded this.)
### Patches
Fixed in **1.3.1** (the fix was developed on the `v1.3.0` tag, which never published to npm; 1.3.1 is the first published release with the fix). Upgrade to `>= 1.3.1`.
### Workarounds
Run a single vault per server process, or isolate each tenant on a separate process/credential.
### Fix
A central `input.vault === ctx.vaultId` guard was added in dispatch before the scope check.
CVE-2026-105411 is a high-severity authorization bypass vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. It allows an attacker with tracker administration rights on one tracker to update or delete fields of all trackers on the instance without proper authorization.
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress versions up to 5.0.2 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access other customers' printable order documents by supplying the order ID and the associated billing email address. The vulnerability arises because the plugin authorizes access based on a non-secret billing email rather than the WooCommerce order key. This can expose sensitive customer information including names, addresses, phone numbers, purchased products, prices, taxes, and invoice metadata.
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.
The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.2 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to manipulate a user-controlled parameter to create approved appointments linked to other customers' order items. The vulnerability arises because the plugin does not verify ownership, payment status, or capacity for the referenced order items. Attackers can also access personal information such as names, email addresses, and order codes of other customers. The issue is due to insufficient validation in specific routes handling booking steps.
The Bookly plugin for WordPress up to version 28.4 contains an authorization bypass vulnerability due to insecure direct object reference via user-controlled parameters. Authenticated users with subscriber-level access or higher can exploit this flaw to overwrite the WordPress account binding of any Bookly staff record, including administrators, leading to privilege escalation. Exploitation requires the attacker to be linked to at least one Bookly staff record, which is enabled by default on fresh installs with a specific option active.
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.
This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have an authorization bypass vulnerability due to a user-controlled key. This flaw allows a low privileged remote attacker to potentially elevate their privileges. The vulnerability is identified as CWE-639 and has a CVSS score of 4.3, indicating medium severity.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an authorization bypass vulnerability (CWE-639) that allows a low privileged remote attacker to elevate privileges by exploiting a user-controlled key. This vulnerability has a high severity with a CVSS score of 7.1. No official patch or remediation information is provided in the input data.
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
CVE-2026-10631 is an authorization bypass vulnerability in Zimbra Collaboration Suite versions 10.1.0 through 10.1.19. It affects the EWS FindItem handler, allowing an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without proper share or delegation permissions. The vulnerability has a CVSS score of 6.5, indicating medium severity.
Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects OctoCloud: from 1.12.06 before 1.12.07.
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.