CVE-2026-55166 is a critical improper authorization vulnerability in Netflix Lemur versions prior to 1.9.2. Authenticated users could manipulate the ACME authority URL without proper server-side restrictions, enabling server-side request forgery (SSRF) to internal cloud services and metadata endpoints. Additionally, authorization flaws could allow continued access to private certificate key material after ownership or role changes, with insufficient audit logging to detect such access. The vulnerability could lead to exposure of cloud credentials and long-lived private keys. The issue is fixed in Lemur version 1.9.2 by adding host allowlist validation and improving audit context for key exports.
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.
Kurrier versions prior to 1.2.4 have an authorization bypass vulnerability in API endpoints for listing and retrieving webhook and identity resources. Authenticated users with valid API keys could access metadata of other users' webhook and identity resources by using identifiers from those accounts. This issue affects GET and list operations but does not allow anonymous access or cross-user modifications. The vulnerability is fixed in version 1.2.4.
authentik versions prior to 2026.2.6 and between 2026.5.0 and before 2026.5.5 contain an authorization bypass vulnerability in the Remote Access Control endpoint listing. Authenticated users can retrieve all configured endpoints and their connection settings, including stored credentials, regardless of their access rights. This flaw allows unauthorized access to managed RDP, SSH, and VNC targets, exposing sensitive credentials and enabling interactive access to systems outside the user's authorization scope. Deployments not using the enterprise Remote Access Control provider are not affected. The issue is fixed in versions 2026.2.6 and 2026.5.5.
CVE-2026-19869 is an authorization bypass vulnerability in the neo4j/graphql library affecting versions 5.2.0 through 5.12.14, 6.0.0 through 6.6.4, and 7.0.0 through 7.5.9. The flaw occurs when both type-level and field-level @authentication rules are defined on the same operation type; only the type-level rule is enforced, causing stricter field-level rules to be ignored. This allows users with a valid token meeting the broader type-level requirements but lacking stricter field-level permissions (e.g., admin role) to access restricted fields. No token forgery is involved, but legitimate non-admin tokens can bypass intended restrictions. The vulnerability has a CVSS 4.0 score of 7.6 (high severity).
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4.
Vvveb CMS versions prior to 1.0.8.4 contain an authorization bypass vulnerability in the backend post revision operations. Low-privileged Authors can access, restore, or delete post revisions belonging to other Authors due to improper validation of user-controlled parameters without enforcing the current admin_id. This can lead to exposure of draft content, unauthorized content modification, and loss of audit history. The issue is fixed in version 1.0.8.4.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id and do not verify product_question.product_id against product.admin_id for the current admin_id. An attacker can read pending question content and moderation data, change question status, edit question content, or delete questions, manipulating product Q&A visibility and integrity. This issue is fixed in version 1.0.8.4.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql trusts caller-controlled product_id, language_id, and created_at values without applying the current admin_id to revision reads, restores, and deletes. An attacker can read historic product content, restore a revision over another Vendor's live product content, or delete revision records, exposing private copy, corrupting product pages, and removing audit history. This issue is fixed in version 1.0.8.4.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql loads and mutates products without consistently applying the current admin_id when view_other_products or edit_other_products is absent. An attacker can read product details, duplicate products, or delete products and related catalog data, exposing commercial information and causing unauthorized copies, catalog pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.
Vvveb CMS versions prior to 1.0.8.4 contain an authorization bypass vulnerability allowing low-privileged Authors to access, duplicate, or delete posts owned by other Authors. This occurs because the backend post operations permit user-controlled filters that override admin restrictions and inconsistent enforcement of ownership in the database. Exploitation can expose private drafts and cause content loss or disruption. The issue is fixed in version 1.0.8.4.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled comment_id without verifying comment.post_id against post.admin_id for the current admin_id. An attacker can read pending comment content and commenter email addresses, change moderation status, edit comment content, or delete comments, breaking author and moderation boundaries. This issue is fixed in version 1.0.8.4.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php controllers and the admin/sql/sqlite/digital_asset.sql data queries use a caller-controlled digital_asset_id without consistently enforcing the current admin_id ownership boundary. An attacker can list assets, read asset names and file metadata, edit asset metadata, or delete asset records, which can disclose private product metadata, corrupt resource links, and cause data loss. This issue is fixed in version 1.0.8.4.
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects EdoWEB: before 780-g7.
Onyx Enterprise Edition versions prior to 4.3.0 contain an authorization bypass vulnerability in specific user group management endpoints. This flaw allows a curator to add accounts to arbitrary user groups without proper validation, potentially granting unauthorized document access. The issue is resolved in version 4.3.0.
ApostropheCMS versions prior to 4.32.0 contain an authorization bypass vulnerability in the page move operation. A regression in the move authorization guard disables the check that ensures a page can only be moved into a parent page the user has create rights over. This allows any authenticated user with edit rights on a page to move it under a restricted parent they lack create or edit permissions for. The move triggers an unchecked database update that re-ranks the restricted parent's children, potentially affecting documents the user cannot edit. The vulnerability is reachable via the documented REST API PATCH/PUT route with attacker-controlled parameters.
ShopSmart Loyalty for WooCommerce plugin versions through 1.0.0 allow unauthorized access to customer loyalty profiles via a phone-number lookup feature. This occurs because the plugin does not verify authorization or ownership before returning customer data. As a result, anyone knowing a customer's phone number can retrieve sensitive information including name, email, and account balance.