InvoicePlane versions prior to 1.7.2-beta-1 contain an authorization bypass vulnerability allowing guest users to approve or reject quotes belonging to clients other than their own. This occurs because certain methods do not properly restrict access based on client assignment, enabling unauthorized quote status changes and email notifications. Additionally, guest users can mark other clients' quotes as viewed. These issues are resolved in version 1.7.2-beta-1 and later.
A vulnerability in langgraph-api versions from 0.1.2 up to but not including 0.15.0 allows an authenticated user to bypass authorization controls due to improper handling of namespace rewriting in JavaScript or TypeScript custom authentication Store authorization handlers. This flaw enables unauthorized access to another user's Store namespace, potentially leading to unauthorized reads, overwrites, searches, or deletions. The issue is resolved in version 0.15.0.
CVE-2026-59979 is an authorization bypass vulnerability in YosemiteCrew's Yosemite-Crew platform. Several API routes related to service and PMS task-library/template management lack proper organization and permission checks, allowing any registered user to read, modify, or delete data belonging to other organizations. Some service records can be read without any authentication. This flaw affects the integrity and availability of service catalogues and task templates, impacting bookings and billing processes. No fixed release or patch is currently established.
A vulnerability in identrail prior to version 1.0.2 allows an authenticated tenant to bypass authorization checks on the GitHub installation ID parameter. This flaw permits reading private repository data and metadata of other organizations if identrail's GitHub App is installed there. The issue arises because the installation ID is accepted without verifying ownership by the caller's workspace. The vulnerability is fixed in version 1.0.2.
CVE-2026-87098 is a low-severity vulnerability in Acronis Cyber Protect 17 (Linux and Windows) before build 42587. It involves improper authorization that could lead to sensitive information disclosure due to an authorization bypass through a user-controlled key. The issue is fixed in build 42587.
CVE-2026-111961 is a vulnerability in the Royal MCP WordPress plugin versions before 1.5.10. The plugin fails to perform object-level permission checks when duplicating pages, relying instead on a generic capability. This flaw allows users with contributor-level access to read the full content of any private or draft page and publish it without having the publish capability.
Authlib versions from 0.15 up to but not including 1.9.1 contain an authorization bypass vulnerability in the ClientConfigurationEndpoint implementations. These implementations improperly verify client permissions by only checking if the target client is editable, without confirming that the request credential belongs to that client. This flaw allows a client with any valid registration access token to read, modify, or delete other clients' registrations. Modifying redirect_uris can lead to authorization code or token interception, and deleting registrations can cause denial of service for affected clients. The vulnerability is fixed in version 1.9.1.
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects EdoWEB: before 780-g7.
CVE-2026-2270 is an authorization bypass vulnerability in the Kubernetes StatefulSet controller. It allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a pod in a different namespace. The attacker can fully control the pod's metadata and specification, including selecting the namespace. However, the cross-namespace pod is deleted by the garbage collector unless the attacker can reference a valid StatefulSet OwnerReference in the victim namespace.
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions.
Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
CVE-2026-96581 is an authorization bypass vulnerability in ash-project ash affecting versions from 1.22.0 up to but not including 3.37.2. It allows a user from one tenant to read, overwrite, and take over records belonging to another tenant via an upsert create action. This occurs because the upsert operation does not properly scope conflicting records to the request's tenant, enabling unauthorized access and modification. The vulnerability is fixed in version 3.37.2.
A vulnerability in the WPVR WordPress plugin before version 9.0.3 allows users with contributor-level access and above to update virtual tours created by other users without proper ownership checks. This authorization bypass can lead to unauthorized modification, reconfiguration, and publishing of virtual tours.
A vulnerability in the WPVR WordPress plugin before version 9.0.3 allows users with contributor-level access and above to read and modify virtual tours created by other users due to missing object-level authorization checks.
CVE-2026-115998 is an Insecure Direct Object Reference (IDOR) vulnerability in CervantesSec cervantes version v1.3-beta. It allows an authenticated attacker to access sensitive data such as findings, proof-of-concept details, credentials, and client information from projects they are not authorized to access. The attacker can also modify finding statuses and transfer findings to their own projects, impacting data confidentiality and integrity.
CVE-2026-115994 is an authorization bypass vulnerability in CervantesSec cervantes version v1.3-beta. It allows an attacker with limited privileges to modify or delete targets belonging to other projects without proper authorization. This compromises the integrity of penetration testing scopes, results, and associated security reports.
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
CVE-2026-93634 is an authorization bypass vulnerability in Zimbra Collaboration Suite (ZCS) versions up to 10.1.20. It allows an authenticated user to insert forged shared-file records into another user's mailbox without proper authorization checks. The flaw involves the FileSharedWithMeRequest, which accepts attacker-controlled file metadata and owner identifiers without validating an actual document share. Exploitation does not require victim interaction.
CVE-2026-115453 is an authorization bypass vulnerability in the MarcosCamara01 Ecommerce Template affecting the cart and wishlist repositories. It allows any authenticated user to delete or modify cart and wishlist entries belonging to other users due to improper enforcement of PostgreSQL row level security. The application connects as the table owner, bypassing row-level security policies that rely on user ID checks. Sequential identifiers enable enumeration of other users' cart and wishlist items, leading to unauthorized data modification or deletion.
A vulnerability in the Photo Engine (Media Organizer & Lightroom) WordPress plugin before version 6.5.8 allows authenticated users with author role or higher to delete media attachments they are not authorized to, including those uploaded by other users and administrators. This is due to missing authorization checks on targeted media attachments.