CWE-639: Insecure Direct Object Reference vulnerabilities

CVE-2026-78412 is an authorization bypass vulnerability in Rapid7 Velociraptor's WatchEvent gRPC API. The API allows specifying the OrgId to stream events from, but the server incorrectly checks permissions against the caller's organization rather than the requested one. This flaw enables a user with API access in one organization to read events from another organization without authorization. The vulnerability affects Velociraptor versions prior to 0.77.3. The CVSS score is 4.9, indicating medium severity.

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs to the same workspace, is not a member of the victim's secret project, and knows the target asset UUID can receive a 302 redirect to a signed download URL. The intended project-scoped route for the same asset correctly returns 403. Confirmed affected project-bound asset types are ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER. This bypass exposes private file content protected by the secret project boundary. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed in 1.4.0.

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.

A vulnerability in the Razorpay for WooCommerce WordPress plugin before version 4.8.8 allows unauthenticated attackers to modify shipping information on arbitrary orders via a REST API route that lacks proper ownership or authorization checks.

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary ticket responses belonging to other users by supplying any stsw_responses row ID to the deletion handler after obtaining the nonce from the admin footer.

CVE-2026-104403 is an authorization bypass vulnerability in ThimPress LearnPress that arises from user-controlled keys allowing incorrect access control. It affects LearnPress versions up to 4.4.9. The vulnerability has a medium severity with a CVSS score of 5.3 and does not require user interaction or privileges to exploit. There is no information about available patches or vendor advisories at this time.

Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This issue affects Advanced Ads: from n/a through 2.0.26.

CVE-2026-94405 is an authorization bypass vulnerability in Shahjada Download Manager that allows an attacker to retrieve embedded sensitive data by exploiting a user-controlled key. The issue affects versions up to 3.3.71. The vulnerability has a CVSS score of 5.3, indicating medium severity, and does not require privileges or user interaction to exploit.

The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.1 contains an authorization bypass vulnerability due to insecure direct object reference. This flaw allows unauthenticated attackers to enumerate invoices of arbitrary customers and create unauthorized transaction intents linked to other customers' data. The vulnerability arises because the plugin's PayPal transaction creation handler does not verify ownership or require an access key, unlike other payment handlers. Exploitation can disrupt legitimate payment flows by invalidating transaction intent keys.

CVE-2026-100517 is an authorization bypass vulnerability in VillaTheme Photo Reviews for WooCommerce plugin versions prior to 1.2.31. The flaw arises from incorrectly configured access control security levels that allow an attacker to bypass authorization using a user-controlled key. This vulnerability affects versions from initial release up to 1.2.30 and has a high severity rating with a CVSS score of 7.5. A fix is available in version 1.2.31.

Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

LearnPress – WordPress LMS Plugin versions up to 4.4.8 contains an authorization bypass vulnerability due to insecure direct object references. This flaw allows unauthenticated attackers to access and download course material files from paid or enrollment-required courses if any course on the site has 'No Required Enroll' enabled. The vulnerability arises because the AJAX endpoint lp-ajax-handle (load_content_via_ajax) does not perform capability checks and authorizes access based on one attacker-controlled identifier while fetching data using another unchecked identifier.

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.

Simply Schedule Appointments WordPress plugin versions up to 1.6.12.31 contain an authorization bypass vulnerability via the 'complete_group' parameter. Authenticated users with subscriber-level access or higher can exploit missing validation on a user-controlled key to access private appointment tokens and personally identifiable information (PII) of co-bookers. Attackers can then use leaked tokens to read, modify, or cancel appointments of other users within the same group booking.