CWE-639: Insecure Direct Object Reference vulnerabilities

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user, and `GET /ws/terminal/:id` and `GET /ws/file/:id` only check whether the supplied UUID exists. An authenticated RoleMember who obtains a live stream UUID from logs, browser history, referer data, or telemetry can attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands. This issue is fixed in version 2.0.10.

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token.

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's order_id to copy their cart contents and address data into the attacker's session. The CSRF token was validated but ownership was not checked.

CVE-2026-77780 is an authorization bypass vulnerability in Roskus Prospero Flow CRM versions 4.9.1 through before 5.14.2. It allows a user with transaction and accounting creation permissions to access sensitive bank account information of other companies by supplying a bank_account_id or bank_card_id in the transaction save endpoint. The sensitive data disclosed includes bank account name, bank name, and the last four digits of the card. This occurs because the application does not verify company ownership before persisting and rendering this information.

CVE-2026-77759 is an authorization bypass vulnerability in Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5. It allows an authenticated user to access transaction data belonging to other companies on the same instance by manipulating the transaction ID in the API request. The flaw exists because the transaction API does not enforce company scoping or permission checks when resolving transaction identifiers.

The Duplicate Post WordPress plugin before version 1.5.6 contains an authorization bypass vulnerability. This flaw allows users with delegated roles to duplicate another user's password-protected post and republish it as publicly readable without proper permission checks.

CVE-2026-62945 is an authorization bypass vulnerability in mauriceboe TREK prior to version 3.1.3. The issue allows authenticated users with file-edit permissions on any accessible trip to link files to foreign reservations, places, or assignments without proper verification that these objects belong to the trip. This leads to unauthorized disclosure of reservation titles across private trip boundaries. The vulnerability is fixed in version 3.1.3.

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.

BigBlueButton versions prior to 3.0.29 contain an authorization bypass vulnerability where presenters can delete presentations from other meetings by submitting a presentationId without proper verification. This flaw allows disruption of presentation availability across meetings. The issue is fixed in version 3.0.29.

A vulnerability in django CMS prior to version 5.0.9 allows an authorization bypass during page duplication. The flaw arises because the duplication process does not properly check object-level permissions on the source page, enabling a user with staff privileges to duplicate content from pages they are not authorized to view. This can expose restricted content when CMS_PERMISSION is enabled. The issue is fixed in version 5.0.9.

A vulnerability in django CMS prior to version 5.0.9 allows an active staff user without proper permissions to access placeholder-related data by guessing content type and object IDs. This authorization bypass exposes placeholder slot names, plugin trees, plugin identifiers, labels, and object existence information for frontend-editable objects. The issue is fixed in version 5.0.9 by applying proper authorization checks.

A vulnerability in django CMS versions prior to 5.0.8 allows a staff user with global add permission for a plugin type to copy plugins from unauthorized pages or placeholders into their clipboard. This occurs because the copy_plugins endpoint does not properly validate the source placeholder, leading to an authorization bypass. The flaw enables reading of secret text, link names, and URLs from unauthorized content. The issue is fixed in version 5.0.8.

ATutor version 2.2.4 is affected by an authorization bypass vulnerability (CWE-639) that allows any authenticated user to delete another user's profile picture by supplying their member_id in a POST request. This insecure direct object reference (IDOR) affects profile picture endpoints and can impact users including instructors and administrators. The product is no longer actively supported and no fixes are available.

ATutor version 2.2.4 contains an authentication bypass vulnerability due to uninitialized token validation values in the auto-login functionality. An attacker who knows a user's identifier and registration timestamp can generate a valid token to authenticate as that user, including administrators, without a password. The product is no longer actively supported and this vulnerability remains unpatched.

CVE-2026-59992 is an authorization bypass vulnerability in the TinaCMS headless content management system affecting certain media adapter packages prior to versions 23.0.4 (next-tinacms-s3 and next-tinacms-dos), 14.0.4 (next-tinacms-azure), and 26.0.4 (next-tinacms-cloudinary). Authenticated CMS editors can exploit this flaw to create or delete storage objects outside the intended media root, potentially impacting other tenants or non-media objects. The issue arises from missing key-boundary checks on user-controlled object keys passed to storage SDK upload and delete operations. A fix is available in the specified versions.

CVE-2026-53546 is a critical authorization bypass vulnerability in Termix, a web-based server management platform. Versions prior to 2.3.2 allow an authenticated low-privileged user to exploit a flaw in the terminal WebSocket host resolution process. The vulnerability arises because the system accepts a user-controlled hostConfig.id and resolves it without verifying ownership or explicit access. This can lead to Termix authenticating to an attacker-controlled SSH server and disclosing another user's stored SSH credentials while their data key is unlocked. The issue is fixed in Termix version 2.3.2.

CVE-2026-53548 is a critical improper authorization vulnerability in Termix-SSH's Termix platform prior to version 2.6.1. It allows any authenticated user with a valid JWT to enumerate host IDs and retrieve plaintext SSH or sudo passwords of other users by exploiting insufficient host ownership checks on a specific API endpoint. This can lead to unauthorized access and control of managed systems outside the Termix instance. The issue is fixed in version 2.6.1.

Leantime JSON-RPC API versions up to 3.8.0 have a missing authorization vulnerability in the JSON-RPC dispatcher. This flaw allows authenticated users to invoke service-layer methods without proper permission checks, enabling actions such as modifying other users' accounts and resetting passwords. The vulnerability arises from the dispatcher not enforcing centralized authorization, distinct from other known CVEs affecting Leantime. This can lead to account takeover and full compromise of affected user accounts.

A vulnerability in Wekan versions 9.57 through 9.73 allows any authenticated user who is not a board member to download private board data. The issue arises because an asynchronous authorization check was not awaited, causing the export function to run regardless of access permissions. This flaw was fixed in version 9.74.