CWE-639: Insecure Direct Object Reference vulnerabilities

CVE-2026-102107 is a medium severity vulnerability in Kiteworks Core involving an authorization bypass in the file-request feature. An authenticated user can send a request that appears to originate from another user because the server does not verify authorization properly. Exploitation requires the feature to be enabled for the attacker and the targeted recipient to act on the request. This flaw could allow solicitation of files or information under a trusted identity.

CVE-2026-102139 is an authorization bypass vulnerability in the large file exchange feature of Kiteworks Email Protection Gateway. It allows an authenticated user to access the subject, message body, and attachments of email packages they neither sent nor received. This occurs because the system does not properly verify that the requesting user is a party to the requested package.

CVE-2026-103446 is an authorization bypass vulnerability in the Wikimedia Foundation's MediaWiki WikiLambda extension version 1.46. It involves a user-controlled key that allows authentication bypass, potentially enabling unauthorized access. The vulnerability has a high severity with a CVSS score of 7.4. A patch is available for this issue. The affected product is a cloud service, and the vendor manages remediation for this service.

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.

Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.

Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.

Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.

Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.

sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account. This issue was fixed in version 5.8.0~ynh9.

sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password. This issue was fixed in version 5.8.0~ynh9.

A vulnerability in Joomla! CMS versions 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3 allows unauthorized creation of guest-level user accounts via the profile.save controller. This occurs because the controller does not verify the login state of the user, enabling account creation on sites without active user registration.

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind that ID to the session that uploaded the file, the current user, the form, the upload field, or the temporary state. Any guest can obtain a token for their own session, so the token prevents CSRF but does not authorize the target object.

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.