CVE-2026-63338 is an authorization vulnerability in inex IXP-Manager versions prior to 7.3.0. Authenticated users can view and modify API key records belonging to other users due to missing user ownership checks in the ApiKeyController. This flaw allows unauthorized access and modification of another user's API keys. The issue is resolved in version 7.3.0.
A vulnerability in hargata lubelog prior to version 1.6.8 allows an authenticated user to bypass authorization checks when retrieving vehicle maintenance records. The flaw exists because the application verifies access to the vehicle ID but does not verify that each requested record ID belongs to that vehicle. This enables cross-user disclosure of sensitive vehicle maintenance data including descriptions, costs, notes, mileage, and attachment metadata. The issue is fixed in version 1.6.8.
CVE-2026-62991 is an authorization bypass vulnerability in shopperlabs shopper prior to version 2.10.1. It allows authenticated staff with certain permissions to access arbitrary user profiles, including administrator and staff accounts, without having the required view permissions. This flaw also enables user-ID enumeration and potential destructive actions on non-customer accounts if additional permissions are held. The issue is fixed in version 2.10.1.
CVE-2026-116239 is an improper authentication vulnerability in pgAdmin 4 server mode before version 9.19. It allows an LDAP or Kerberos authenticated user to be logged in as a different account with the same username but a different authentication source, including potentially an internal administrator account. This occurs because pgAdmin 4 incorrectly selects the logged-in account by username alone without verifying the authentication source. The issue is fixed in version 9.19 by ensuring the account is matched to both the authenticated username and source.
Immich versions prior to 3.0.0 contain an authorization bypass vulnerability allowing view-only partners to enumerate GPS coordinates and identifiers of archived photos or videos shared by others. This exposure is limited to location metadata and asset identifiers; the actual image data remains protected. The issue is resolved in version 3.0.0.
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared "continue later" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.
CVE-2026-55551 is an improper authorization vulnerability in infonl dimpact-zaakafhandelcomponent (ZAC) versions prior to 5.2.0. It allows authenticated low-privileged municipal users to access sensitive case management data across unauthorized case types by exploiting missing authorization checks on certain by-id read endpoints. The vulnerability permits unauthorized reading of decisions, audit histories, process diagrams, and mailbox configurations. The issue is fixed in version 5.2.0.
CVE-2026-61708 is an improper access control vulnerability in SOCFortress CoPilot prior to version 0.1.76. It allows low-privilege customer users to upload files to arbitrary storage buckets and object names without restrictions, enabling overwriting of cross-tenant data such as endpoint telemetry, report templates, and forensic artifacts. This can lead to tampering with evidence, poisoning of reports for potential code execution, and denial of service via storage exhaustion. The issue is fixed in version 0.1.76.
Business-GoCardless versions prior to 1.01 for Perl contain an authorization bypass vulnerability due to improper validation of the redirect flow ID against the user session. This flaw allows an attacker who obtains another customer's redirect flow ID to create payments or subscriptions on that customer's mandate without authorization. The vulnerability is fixed in version 1.01.
CVE-2026-61671 is a high-severity vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.7 allow authenticated users to bypass ownership checks on various CRUD operations, exposing sensitive personal and financial data. Additionally, some control modules lack proper CSRF protections, enabling attackers to perform unauthorized state-changing actions via victim sessions. The issue is fixed in version 3.8.7.
Kubeflow Pipelines versions prior to 2.17.0 contain an authorization bypass vulnerability in the frontend artifact routes. Authenticated users could access artifact contents belonging to other tenants by manipulating the namespace parameter or omitting it, bypassing tenant isolation. This affects multi-user deployments relying on Kubeflow Pipelines authorization for namespace isolation. The vulnerability does not allow disclosure of Kubernetes Secrets, modification of storage, or server-side code execution. The issue is fixed in version 2.17.0.
CVE-2026-118084 is an authorization bypass vulnerability classified as CWE-639 affecting nicdark Hotel Booking versions up to 3.8. It involves insecure direct object references (IDOR) that allow a user to bypass authorization controls by manipulating user-controlled keys. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level with high confidentiality impact but no integrity or availability impact.
CVE-2026-115706 is an authorization bypass vulnerability in Elastic Cloud Enterprise (ECE) that allows privilege escalation. An attacker controlling any host in an ECE installation can obtain credentials reserved for other platform roles, potentially gaining full control over the ECE control plane and managed deployments. The vulnerability affects versions from 1.0.0 through 3.8.5 and from 4.0.0 through 4.2.0. The CVSS score is 6.8, indicating a medium severity impact.
CVE-2026-111417 is a broken access control vulnerability in Foxit Software Inc.'s official website HTML-to-PDF conversion service. The issue arises from the use of a shared token for submitted conversion documents, which may allow unauthorized users to access documents submitted by others. The vulnerability has a high severity with a CVSS score of 7.5. No affected versions or patches have been specified.
The Photo Engine (Media Organizer & Lightroom) WordPress plugin versions before 6.6.0 contain an authorization bypass vulnerability in a REST API route. Authenticated users with Author-level access or higher can modify post data, including titles, content, excerpts, and other fields, for arbitrary posts, pages, and attachments, even those owned by other users.
CVE-2026-108763 is an authorization bypass vulnerability in the Wallet System for WooCommerce WordPress plugin versions before 2.8.2. The flaw allows authenticated users with minimal privileges to overwrite KYC documents and verification status of any other user, including administrators, by exploiting a lack of ownership checks on a user ID parameter in the KYC document submission handler.
openEQUELLA versions before 2026.1 contain an authorization bypass vulnerability in the GET /api/userquery/userinfobackup endpoint. This endpoint lacks authentication and authorization checks, allowing unauthenticated attackers to retrieve personal details of other users within the same institution by supplying their uniqueId. The exposed information includes username, first name, last name, and email address.
Open Object versions from 2.4.3 up to but not including 2.5.1, 3.6.2, 4.0.2, and 4.1.1 contain an authorization bypass vulnerability. This flaw allows an API token scoped to read one ObjectType to access the full versioned record of objects from other ObjectTypes via the history-detail endpoint. The vulnerability arises because the history-detail action bypasses per-object permission checks, exposing potentially sensitive data such as citizen or case records. The issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.
MailWatch for MailScanner versions prior to 1.2.27 contain an authorization bypass vulnerability allowing authenticated users with low privileges to release or permanently delete quarantined emails belonging to other users or domains. This occurs because the application does not verify ownership of the message ID supplied to the quarantine action endpoint, enabling unauthorized mail manipulation. The issue is fixed in version 1.2.27.