GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.
Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. From 0.21.0 until 0.29.0, the Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs keys an authorized AdmittedTarget by username, target_name, and client IP rather than by the immutable user UUID, while KubernetesSessionHandle::close does not evict the entry. If an account is deleted and a different low-privilege account is created with the same username, the replacement account can successfully authenticate as that recreated username and reuse the predecessor's still-live correlation entry when requesting the same target from the same client IP before kubernetes.session_max_age expires. Current-request authentication still occurs, but the reused entry bypasses a fresh target authorization check and can cause Warpgate to proxy requests with Kubernetes target credentials that the replacement account is not authorized to use, exposing cluster resources or permitting unauthorized mutations. This issue is fixed in version 0.29.0.
Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions.
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.
CVE-2026-119215 is an authorization bypass vulnerability in team-alembic's ash_authentication component versions from 5.0.0-rc.0 up to but not including 5.0.0-rc.16. It allows an authenticated user to install a TOTP secret they control on another user's account, enabling them to sign in as that user or bypass the second factor. The flaw arises because the ConfirmSetupChange function verifies a setup token without confirming it belongs to the targeted user record, combined with policy bypasses that fail to restrict setup actions to the actor's own record.
CVE-2026-108046 is an IDOR (Insecure Direct Object Reference) vulnerability in AM System's ALO Suite version 25_09_15.03_35. It arises from insufficient authorization checks on the '/Companies/Edit/{id}' endpoint, allowing unauthenticated remote attackers to modify object identifiers to access data belonging to other companies or users. This leads to unauthorized disclosure of sensitive application data.
CVE-2026-120328 is an authorization bypass vulnerability in the TYPO3 Extension "Mail" affecting versions >=4.0.0 <4.2.0 and >=0 <3.12.5. The click tracking middleware fails to validate the authentication code of newsletter recipients when the code is omitted, allowing unauthenticated attackers to access personal data embedded in email links. This vulnerability has a medium severity with a CVSS score of 6.9. Fixed versions are 4.2.0 and 3.12.5.
CVE-2026-120333 is a high-severity authorization bypass vulnerability in the TYPO3 Extension "Frontend User Registration". The flaw allows unauthenticated attackers to perform sensitive actions such as confirming registrations or deleting accounts without a valid hash, by exploiting the lack of proper validation. This enables attackers to retrieve email addresses or usernames of all frontend users and delete arbitrary user accounts. The issue affects versions prior to 14.0.3 and 13.2.5, where it has been fixed.
Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.
CVE-2026-109142 is an authorization bypass vulnerability in NLnet Labs Krill where a parent CA on the same server trusts a child identity provided by the caller without verifying its legitimacy. This flaw arises because the system runs the RFC 6492 provisioning exchange in-process instead of verifying a signed CMS message, allowing unauthorized child identities to be accepted.
CVE-2026-109141 is an authorization bypass vulnerability in NLnet Labs Krill. It allows a role restricted to a list of Certificate Authorities (CAs) to gain full permissions for requests not tied to a specific CA, including the bulk import endpoint. This enables unauthorized creation of child CAs with access to resources of the parent CA and the creation of Route Origin Authorizations (ROAs) specified in the request.
CVE-2026-113511 is an authorization bypass vulnerability in Apache Syncope that allows a delegated administrator to relocate a Realm subtree across administrative realm boundaries without proper permission. This affects Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Upgrading to versions 4.0.9 or 4.1.4 addresses this issue.
CVE-2026-120263 is a critical improper authentication vulnerability in Gitea versions prior to 28.3.0. When the oauth2_client ACCOUNT_LINKING setting is set to auto and registration is enabled, the account linking process incorrectly allowed an attacker to link their OAuth2 identity to another user's Gitea account by submitting that user's username or email. This flaw could let an attacker sign in as the victim without a password, including administrator accounts. The issue is fixed in Gitea 28.3.0 by requiring that automatic linking only occurs when the existing account matches the OAuth2 provider's email or username; otherwise, the account password is required.
CVE-2026-63401 is an authorization bypass vulnerability in roostorg's open source review tool Coop prior to version 1.0.2. The flaw allowed authenticated users with MRT queue-edit permission in one organization to grant or revoke manual review queue access for users in other organizations due to missing organization scoping in certain functions. No confidential data disclosure occurred as the attacker could not read other organizations' queues or jobs. The issue is fixed in version 1.0.2.