CWE-639: Insecure Direct Object Reference vulnerabilities

CVE-2026-65523 is a high-severity vulnerability affecting Formidable Forms Signature Online Contract Automation versions up to and including 2.0.1. It is an unauthenticated Insecure Direct Object Reference (IDOR) issue that allows an attacker to bypass authorization controls by manipulating user-controlled keys. This vulnerability could lead to unauthorized access to sensitive data without requiring authentication.

CVE-2026-28180 is a medium severity vulnerability in Mercado Pago payments for WooCommerce versions up to and including 8.9.0. It involves an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability, classified under CWE-639, which allows authorization bypass through a user-controlled key. This vulnerability could allow an attacker to access certain resources without proper authorization. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-14314 is a medium severity vulnerability in the PeproDev WooCommerce Receipt Uploader WordPress plugin up to version 2.8.0. The plugin fails to verify that an attachment requested via an access token belongs to the referenced order. This flaw allows unauthenticated attackers to forge tokens and access image attachments, including payment receipts uploaded by other customers, leading to unauthorized disclosure of sensitive information.

PeproDev WooCommerce Receipt Uploader WordPress plugin versions up to and including 2.8.0 are vulnerable to an authorization bypass vulnerability. This flaw allows unauthenticated users to perform write operations due to missing authorization checks, specifically an IDOR (Insecure Direct Object Reference) issue. The vulnerability requires WooCommerce to be installed and can lead to unauthorized modification of data without authentication.

CVE-2026-48912 is an improper input validation vulnerability in Apache Answer up to version 2.0.1. The flaw allows any authenticated user to delete other users' uploaded files by exploiting a missing ownership check in the avatar-cleanup logic. The issue is fixed in version 2.0.2.

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).

Groundhogg CRM plugin for WordPress up to version 4.5.2 has an authorization bypass vulnerability via its REST API endpoint. Authenticated users with the view_contacts capability but without view_others_contacts can access any contact record, including sensitive personal information and user capabilities. This occurs because the endpoint lacks proper object-level ownership checks.

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

CVE-2026-70476 is an improper access control vulnerability in FlowiseAI Flowise versions prior to 3.1.3. It allows an authenticated attacker to manipulate Stripe subscription operations for other tenants by exploiting insufficient verification of subscription identifiers. This can lead to unauthorized changes in subscription plans or seat quantities, causing financial impact and service disruption. The issue is fixed in version 3.1.3.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in packages/server/src/utils/buildChatflow.ts and packages/server/src/utils/index.ts without checking apiOverrideStatus. This allowed unauthenticated attackers to inject arbitrary properties into the flow execution context of any public chatflow, overwrite values such as chatId, sessionId, and chatHistory, and control values resolved through $flow.* template variables consumed by flow nodes. This issue is fixed in version 3.1.3.

Flowise versions prior to 3.1.3 contain an authorization bypass vulnerability in the OAuth2 token refresh endpoint. This endpoint is unauthenticated by design and allows an attacker to trigger server-side HTTP requests to attacker-controlled URLs without SSRF protections. Sensitive OAuth2 credentials are sent in these requests, and the full remote response is reflected back to the caller. The issue is fixed in version 3.1.3.

CVE-2026-16070 is a low-severity authorization bypass vulnerability in the Brizy WordPress plugin before version 2.8.19. It allows users with Contributor-level access or higher to change the template-type assignment of templates owned by other users due to improper authorization verification. The plugin validates a request parameter different from the one used in the write operation, leading to this issue.

Misskey versions from 2025.3.2 up to but not including 2026.5.4 contain an authorization bypass vulnerability in the Direct Messages feature. This flaw allows access to certain data points without proper permission checks, regardless of account permissions or federation settings. Notes with specified (formerly direct) visibility are not affected. The issue is fixed in version 2026.5.4.

CVE-2026-2346 is a critical authorization bypass vulnerability in the Menulux Software Inc. Mobile App affecting versions up to 12.05.2026. The flaw arises from a user-controlled key that allows an attacker to bypass authorization checks, potentially leading to a software integrity attack. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

A vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.0.9 allows users with vendor accounts to modify product attributes of other vendors. This occurs because the plugin does not verify product ownership on certain REST write endpoints.

A vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.0.9 allows users with a vendor account to change the status of any WooCommerce order on the marketplace without verifying order ownership. This affects a REST endpoint that performs bulk order-status changes, enabling unauthorized modification of orders belonging to other vendors and customers.

GEO my WP WordPress plugin versions before 4.5.5.3 contain an authorization bypass vulnerability. The plugin fails to verify ownership or capability on two logged-in AJAX actions, allowing users with subscriber-level access or higher to modify or delete geolocation records of other users and posts by supplying arbitrary record IDs. This vulnerability has a medium severity rating with a CVSS score of 4.3.