The Eventin plugin for WordPress up to version 4.1.29 has a missing authorization vulnerability that allows authenticated users with subscriber-level access or higher to retrieve email addresses and phone numbers of any WordPress user by manipulating the 'id' parameter in a query string.
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view stored WooCommerce payment gateway credentials — including PayPal API username, password, and signature, as well as Stripe test and live secret keys — injected verbatim into the HTML response of the tour edit screen. The credentials are present in the raw HTTP response regardless of the modal's CSS visibility state, making them trivially accessible by viewing page source.
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.
Kubeflow Pipelines versions prior to 2.18.0 contain an authorization bypass vulnerability in multi-user HTTP endpoints for pipeline uploads. This flaw allows low-privilege tenants or unauthenticated callers (if no authenticating proxy is used) to create or inject pipeline versions without proper write permissions. Exploitation can lead to execution of attacker-controlled pipeline specifications in other tenants' namespaces via recurring runs that follow the latest version. The issue is fixed in version 2.18.0.
CVE-2026-104134 is a missing authorization vulnerability in OpenEMR prior to version 8.3.0. The flaw exists in the search_persons action of library/ajax/person_search_ajax.php, where CSRF validation is performed but no ACL authorization check is done. This allows a low-privilege authenticated user to query patient data and retrieve sensitive personal information such as names, dates of birth, gender, phone numbers, and email addresses. The issue is fixed in OpenEMR version 8.3.0.
CVE-2026-103939 is a missing authorization vulnerability in OpenEMR versions prior to 8.3.0 affecting the Weno module. The file_download.php script lacks access control and CSRF protections, allowing any authenticated user to truncate the weno_pharmacy table. This can also be triggered via cross-site requests through a logged-in victim, potentially emptying the e-prescribing pharmacy directory and causing availability issues. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in several custom report download endpoints. These endpoints validate CSRF tokens but do not enforce patient or medical access control lists (ACLs), allowing low-privilege authenticated users to access clinical quality measure (CQM) report generation and download functions for reports they should not have access to. This can expose sensitive QRDA Category One and Category Three clinical documents. The issue is fixed in OpenEMR version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in the controller dispatch mechanism. This flaw allows low-privilege authenticated users to access administrative functions without proper permission checks, including modifying insurance-routing hosts and credentials and enumerating patient information. The issue is resolved in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in the DORN module. A low-privilege authenticated user can exploit this flaw to delete and deactivate lab-ordering configuration data, potentially corrupting the system and requiring administrator intervention to restore. The issue is fixed in version 8.3.0.
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patient_data. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the set_patient branch. This issue is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability (CWE-862) in the handling of patient identifiers within session data. This flaw allows any authenticated user with low privileges to set an arbitrary patient identifier in their session and subsequently download sensitive patient documents without proper access control. The vulnerability is fixed in version 8.3.0.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on both related records. In the verified Account-to-Contact case, an authenticated user can create a relationship while unable to edit the Account and can delete relationship links to a hidden Contact that cannot be viewed directly. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-61650 is a missing authorization vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. The flaw exists in the POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint, which improperly checks only view and list permissions instead of requiring edit permissions when modifying one-to-many relationship foreign keys. This allows low-privileged users to reassign records, change ownership and security-relevant relationships, potentially expanding access across users and manipulating workflows. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-63111 is a missing authorization vulnerability in SuiteCRM's V8 module API prior to versions 7.15.2 and 8.10.2. It allows low-privileged users to create SchedulerJobs with attacker-controlled target values that are executed with system privileges. This can lead to server-side requests to internal or external hosts, potentially exposing internal services. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
A missing authorization vulnerability in the balbooa.com Gridbox extension for Joomla allows unauthenticated attackers to delete submission or field files in versions prior to 2.20.5.0. This affects versions from 1.0.0 up to and including 2.20.4.2. The vulnerability is identified as CWE-862 and has a CVSS 4.0 base score of 6.9, indicating a medium severity level.
OpenHuman versions prior to 0.57.13 contain a code injection vulnerability via remote direct messages sent through a configured Yuanbao channel. This flaw allows an external sender to execute JavaScript and operating system commands as the OpenHuman user without an approval prompt under certain policy and configuration conditions. The vulnerability is fixed in version 0.57.13.
CVE-2026-73580 is a missing authorization vulnerability in Apache OFBiz up to version 24.09.07. It allows a remote unauthenticated attacker to recursively enumerate sensitive Human Resources data, including department and employee identifiers, position names, and organizational relationships. The issue is fixed in version 24.09.08.
A path traversal vulnerability exists in Apache OFBiz through version 24.09.07, allowing a remote authenticated attacker with Catalog view permission to overwrite arbitrary files writable by the OFBiz process. This occurs due to missing authorization checks in the replaceImageToExistImage service and can be exploited via crafted parameters. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a missing authorization vulnerability in ProductEvents. This flaw allows a remote authenticated user with only catalog view permission to create, modify, or delete product-related data by invoking certain catalog quick-admin events. The issue arises because the servlet authorizes requests against a base view-level permission, while the underlying event methods perform write operations without verifying the required update/create permissions. Upgrading to version 24.09.08 resolves this vulnerability.