Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.
The TrueBooker Appointment Booking and Scheduler System WordPress plugin is vulnerable to an authorization bypass vulnerability in all versions up to and including 1.2.6. The flaw allows unauthenticated attackers to overwrite the email address of any WordPress user, including administrators, by exploiting an AJAX handler that lacks proper authentication and capability checks. This can lead to full account takeover via the standard WordPress password reset process.
Snipe-IT versions prior to 8.4.1 contain an authorization bypass vulnerability that allows non-superadmin users to move assets across company boundaries by submitting a company_id directly, bypassing multi-tenant isolation controls. This issue is resolved in version 8.4.1.
A vulnerability in Grav API Plugin prior to version 1.0.6 allows a non-super user with api.users.write permission to create an API key with super-administrator privileges. This occurs because certain user mutation endpoints omit a critical access check, enabling unauthorized privilege escalation and manipulation of two-factor authentication settings. The issue is fixed in version 1.0.6.
An authorization bypass vulnerability (CWE-639) exists in the J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. This insecure direct object reference issue affects multiple frontend and API actions, allowing unauthorized access to certain resources. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level.
An improper access control vulnerability exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. This flaw allows unauthenticated attackers to take over ownership of listings by supplying arbitrary company and user IDs, even for listings that already have an owner. Version 6.2.3 fixes this issue by restricting the action to authenticated users and only permitting ownership changes for unowned listings.
stigmem-node versions before 0.9.0a12 contain an authorization bypass vulnerability affecting multi-tenant deployments using the stigmem-plugin-multi-tenant. This flaw allows a tenant administrator with write access to their own tenant to access and manipulate quarantined facts of other tenants via the /v1/quarantine endpoints. Single-tenant deployments are not affected.
stigmem-node versions before 0.9.0a12 contain a broken object level authorization (BOLA) vulnerability in the multi-tenant right-to-be-forgotten (RTBF) tombstone mechanism. This flaw allows deletion records to be incorrectly attributed across tenants, undermining data isolation and RTBF guarantees. The issue affects only multi-tenant deployments using the stigmem-plugin-multi-tenant. The vulnerability is fixed in version 0.9.0a12.
KiviCare WordPress plugin versions prior to 4.5.4 contain an authorization bypass vulnerability. Authenticated users with patient-level access can download any media file from the media library, including other patients' medical reports, due to lack of proper entitlement verification.
KiviCare WordPress plugin versions before 4.5.4 contain an authorization bypass vulnerability. Authenticated patient-level users can cancel or reschedule appointments belonging to other patients because the plugin does not verify ownership of the appointment being modified.
SmartCrawl SEO checker, analyzer & optimizer WordPress plugin versions before 3.16.3 have an authorization bypass vulnerability. This flaw allows users with Subscriber role privileges to access titles of private and draft posts and enumerate stored post-meta key names without proper capability checks on two AJAX actions.
YayCurrency WordPress plugin versions before 3.3.5 contain an authorization bypass vulnerability. This flaw allows unauthenticated users to access sensitive financial data such as store order totals, vendors' earnings, balance ledgers, and withdrawal histories by iterating over identifiers without any capability or ownership checks.
The User Verification by PickPlugins WordPress plugin versions up to 2.0.47 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to resend verification emails for arbitrary users without proper authorization checks. The vulnerability enables attackers to reset the email-verification status of any user, including administrators, potentially locking them out of their accounts.
A vulnerability in the Quiz and Survey Master (QSM) WordPress plugin before version 11.2.4 allows users with contributor-level access and above to bypass authorization checks on certain REST API routes. This flaw permits these users to read email-notification and results-page configurations of quizzes created by other users, potentially exposing notification recipient addresses. The issue is due to missing per-object ownership verification on these REST endpoints.
A vulnerability in the Quiz and Survey Master (QSM) WordPress plugin before version 11.2.4 allows users with contributor-level access or higher to modify the front-end text settings of quizzes created by other users due to missing per-object ownership checks.
CVE-2026-14196 is a medium severity vulnerability in the WCFM Marketplace WordPress plugin before version 3.8.1. It allows any marketplace vendor to unapprove or delete reviews belonging to other vendors' stores without verifying ownership. This authorization bypass flaw enables unauthorized modification or permanent deletion of reviews.
The Eventin WordPress plugin versions before 4.1.21 contain an authorization bypass vulnerability that allows users with contributor-level access and above to modify or delete schedule entries created by other users without verifying ownership.
The Eventin WordPress plugin before version 4.1.21 contains an authorization bypass vulnerability. This flaw allows users with contributor-level access or higher to modify, delete, or reassign events created by other users, including administrators, without proper ownership verification.
Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authority_id, serial, or external_id without requiring permission on the underlying authority. PUT /api/1/certificates//revoke authorized the caller against only the selected Lemur row, so the creator of the duplicate bypassed CertificatePermission. The duplicate had no cert.endpoints, which also bypassed the safeguard that prevents revocation of deployed certificates. Issuer plugins then revoked the real CA-side certificate using certificate.body or external_id under the stored authority credentials. An attacker could therefore revoke arbitrary managed certificates and cause fleet-wide TLS denial of service. The fix rejects duplicate authority_id and serial identities, requires authority access on upload, and checks every matching row during revocation. This issue is fixed in version 1.9.3.
Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as replaced. The victim was then excluded from get_all_pending_reissue, and certificate_rotate could deploy the attacker certificate to endpoints serving the victim. An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. The fix authorizes every referenced replacement certificate before mutation. This issue is fixed in version 1.9.3.