Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows Exploitation of Trusted Identifiers.
This issue affects Enocta Platform: through 2026-09-28.
Apache Roller 6.1.5 contains an authorization bypass vulnerability that allows an authenticated user with authoring rights on one weblog to access and modify resources of another weblog. This affects multi-user installations without requiring special configuration. The flaw also permits an administrator on one weblog to overwrite another weblog's Velocity template, potentially affecting content rendering. Upgrading to version 6.1.6 or later mitigates this issue by scoping resource lookups to the acting weblog.
A vulnerability in the Mailchimp for WooCommerce WordPress plugin before version 6.3 allows unauthenticated attackers to access saved cart contents of customers by using a request-supplied identifier derived from the customer's email address. This flaw does not require authentication or ownership verification, enabling attackers to confirm if a customer shops at the store and read their saved cart data.
The Online Scheduling and Appointment Booking System WordPress plugin before version 28.3 contains an authorization bypass vulnerability. Authenticated users with staff-level privileges can access, modify, or delete appointment and payment records of other staff members without proper verification. This includes access to associated customer personal information. The vulnerability arises because the plugin does not verify that the requested records belong to the requesting staff member in its staff-role AJAX actions.
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.
GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.
CVE-2026-100177 is an authorization bypass vulnerability in the ail framework's crawler task creation API. It allows an authenticated user with permission to create crawler tasks to attach another organization's cookiejar by UUID without proper access checks. This can lead to unauthorized use of another organization's stored cookies and session data during web crawls, potentially exposing sensitive session tokens and authentication credentials.
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.
CVE-2026-97636 is an authorization bypass vulnerability in the Apache Airflow HashiCorp provider affecting multi-team deployments using the HashiCorp Vault secrets backend. A user scoped to one team can supply a specially crafted Variable key containing a path separator, causing the backend to resolve secrets belonging to other teams. Single-team deployments are not affected. The issue is fixed in version 4.8.0 and later.
TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any trip can submit identifiers belonging to another user's trip and permanently delete that note-file attachment. Sequential identifiers make broad targeting practical, while attachment read operations remain trip-scoped and are not affected. This issue is fixed in version 3.3.0.
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values without checking that either record belongs to the requesting user. In src/backend/database/routes/credentials.ts, differential errors reveal whether credential and host records exist and disclose each record's authType value. Properly encrypted passwords and keys are not disclosed, but a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. This issue is fixed in version 2.5.1.
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1.
CVE-2026-76907 is an information exposure vulnerability in the suitenumerique docs platform versions 4.8.2 through before 5.4.0. It allows unauthenticated users to enumerate document identifiers, titles, creator data, timestamps, and metadata by exploiting predictable document path values in the search API. Authenticated users can also discover documents accessible via authenticated links, though restricted documents remain protected. The issue is fixed in version 5.4.0.
CVE-2026-87739 is an improper authentication vulnerability in PaperCut NG/MF that allows unauthenticated remote attackers to generate reports without valid credentials. This results in unauthorized access to sensitive information contained in those reports. The vulnerability affects multiple versions of PaperCut NG/MF prior to specific fixed releases.
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once.
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent.