CWE-639: Insecure Direct Object Reference vulnerabilities

CVE-2026-17562 is an authorization bypass vulnerability in Summit Security Systems AdisyonPro that allows unauthorized access to functionality due to improper access control enforcement. This issue affects versions before 5.21.0. The vulnerability is classified under CWE-639, indicating improper authorization checks related to user-controlled keys. The CVSS score is 6.5, reflecting a medium severity level.

CVE-2026-81576 is a high-severity authorization bypass vulnerability in Wibu-Systems-AG CodeMeter Runtime configured as a server. Versions before 8.41a and 9.10 use a cryptographically weak SID as the sole authenticator per connection. An attacker with low privileges can brute-force the SID, recover another session's handle number, and read license information belonging to that session.

Notifima WordPress plugin versions up to and including 3.1.3 contain an authorization bypass vulnerability. This flaw allows authenticated users with Subscriber-level access to unsubscribe other customers from product stock-alert notifications via a REST endpoint without verifying ownership of the subscription. The vulnerability is identified as CWE-639 and has a CVSS score of 4.3, indicating medium severity.

CVE-2026-16568 is a medium severity vulnerability in the Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through version 0.4.62. The vulnerability allows any authenticated user to access other users' personal data via a REST endpoint due to lack of proper ownership verification. This includes sensitive information such as email addresses, names, and user roles.

The Document Embedder WordPress plugin before version 2.3.1 allows unauthenticated attackers to download arbitrary documents, including private and draft ones, by enumerating document IDs. This occurs because the plugin does not verify a document's status before issuing a download token and streaming the file.

A vulnerability in the JEM - Joomla Event Manager extension for Joomla versions 1.0.0 through 5.0.0 allows any logged-in user to read attendee lists for events they do not manage. This includes sensitive information such as attendee names, usernames, registration dates, and statuses, even for unpublished events.

A vulnerability in the Joomla Event Manager (JEM) extension for Joomla allows a registered user with edit-own rights to take over other users' event and venue records by submitting forged form fields. This affects versions 1.0.0 through 5.0.0 of the extension. The issue involves authorization bypass through user-controlled keys, enabling cross-user event and venue takeover.

KubePi versions up to and including 2.0.0 have an authorization bypass vulnerability where cluster-scoped APIs do not consistently validate user access per cluster. This allows authenticated users with cluster management permissions to access or modify clusters beyond their assigned scope. The issue is fixed in version 2.0.1.

CVE-2026-65642 is an Insecure Direct Object Reference (IDOR) vulnerability in WebPros Plesk versions 18.0.79.7 and earlier, as well as versions 18.0.80 through 18.0.80.3. This flaw allows remote authenticated users to read and modify databases belonging to other customers. The vulnerability has a high severity with a CVSS score of 8.6. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-55228 is an authorization bypass vulnerability in Weblate before version 2026.7. The REST API did not properly enforce project- and workspace-scoped team permissions, allowing users to assign projects to teams via unvalidated API requests. This could grant unauthorized access to private projects and allow unauthorized translation, repository, and project management operations. The issue is fixed in version 2026.7.

Dell PowerProtect One versions 20.1.0.0 and below contain an authorization bypass vulnerability (CWE-639) that allows a low privileged remote attacker to manipulate information. This vulnerability does not affect confidentiality or availability but impacts integrity. No official patch or remediation guidance is currently provided by the vendor.

Winter CMS versions up to and including 1.2.12 contain an improper access control vulnerability in the backend FileUpload form widget. This flaw allows an authenticated backend user to read and modify attachment records belonging to other users due to insufficient verification of file ownership. The vulnerability is fixed in version 1.2.13.

Starlette-Admin versions prior to 0.16.1 have a vulnerability where the list API does not properly validate user-supplied order_by and structured where field names against allowed sortable and searchable fields. This allows authenticated users with access to list endpoints to bypass UI restrictions and sort or filter on unintended fields, causing limited exposure of sensitive information. Additionally, malformed field names can cause unhandled exceptions and HTTP 500 errors, resulting in limited denial of service. The issue is fixed in version 0.16.1.

The WP Data Access plugin for WordPress contains an authorization bypass vulnerability (CWE-639) in all versions up to and including 5.5.68. This flaw arises from improper validation in the 'check_app_access' function, allowing unauthenticated attackers to access protected app container data by exploiting a mismatch between authorization checks and data retrieval mechanisms.

The Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.1 contains an authorization bypass vulnerability. It fails to verify that a subscription belongs to the customer associated with the requesting customer-portal session. This flaw allows a user with a confirmed portal session to cancel, reactivate, or modify subscriptions of other customers.

The Project Manager WordPress plugin before version 4.0.7 contains an authorization bypass vulnerability in one of its REST API routes. This flaw allows any authenticated user, including low-privileged roles such as subscribers, to access the activity history, email addresses, and project details of other users without proper permission checks.

CVE-2026-14212 is a medium severity vulnerability in the Booking for Appointments and Events Calendar WordPress plugin before version 9.8. It allows any authenticated employee with access to the Employee Panel to overwrite another employee's cabinet password and take over their account due to missing verification of provider account ownership during updates.

CVE-2026-13404 is a medium severity vulnerability in the Royal Addons for Elementor WordPress plugin before version 1.7.1066. The plugin fails to perform proper capability or ownership checks before allowing modifications to like-count and visitor-tracking metadata on posts. This flaw allows unauthenticated users to alter metadata on any post, including private and draft posts, by exploiting a publicly accessible nonce and an arbitrary post ID key.

CVE-2026-79654 is an authorization bypass vulnerability in Red Hat Satellite 6.16 for RHEL 8 affecting the Katello Content View History API. Authenticated users with permission to view Content Views in one organization may access lifecycle history information of Content Views belonging to other organizations by supplying the identifier of those views. This leads to unauthorized disclosure of publication and promotion events, associated users, and timestamps. The vulnerability has a CVSS score of 4.3, indicating medium severity. Red Hat has published an advisory for this issue and related vulnerabilities in Satellite 6.19, which includes security fixes. No explicit patch version for 6.16 is stated in the input data. The vendor advisory should be consulted for current remediation guidance.

CVE-2026-62861 is an authorization bypass vulnerability in typebot.io prior to version 3.18.0. Authenticated non-guest workspace members could remove another workspace's public custom domain, causing typebots on that domain to become unavailable. The flaw arises because the delete handler authorizes based on a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying domain ownership. This issue is fixed in version 3.18.0.