A vulnerability in the FluentCart A New Era of eCommerce WordPress plugin before version 2.2.0 allows unauthenticated attackers to bypass authorization checks. The plugin does not verify that a stored customer address selected during checkout belongs to the requester. This flaw enables attackers to attach any customer's stored address to an order they place and subsequently read back sensitive customer information such as postal addresses, phone numbers, and company details.
CVE-2026-13319 is an authorization bypass vulnerability in GitLab CE/EE affecting versions from 15.10 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It allows an authenticated user to read milestone metadata such as titles, descriptions, and full project paths from arbitrary private projects without membership. This occurs due to missing authorization checks on a user-supplied project filter parameter in the group milestones API. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
CVE-2026-113727 is an authorization bypass vulnerability in OpenChoreo, a Kubernetes developer platform. Versions from 1.0.0 up to but not including 1.0.6, 1.1.0 up to but not including 1.1.7, and 1.2.0 up to but not including 1.2.5 are affected. The flaw allows an authenticated user with update permissions on a workflow run in a namespace to manipulate ownership labels of other workflow runs within the same namespace, bypassing authorization checks. This can lead to unauthorized read, modify, or delete actions on workflow runs. The issue is fixed in versions 1.0.6, 1.1.7, and 1.2.5.
A vulnerability in the MCP TypeScript SDK versions 1.24.0 through before 1.32.0 allowed clients sharing an InMemoryTaskStore to access and manipulate each other's tasks due to missing session ownership checks. This authorization bypass issue was fixed in version 1.32.0.
ApostropheCMS versions prior to 4.33.0 have a vulnerability in the notification module where PATCH and DELETE REST endpoints allow unauthenticated users to modify or delete notifications by using a valid notification ID. This occurs because the endpoints do not verify authentication or ownership of the target notification. The issue is fixed in version 4.33.0.
CVE-2026-92539 is an authorization bypass vulnerability in Grafana Enterprise affecting instances with SCIM enabled. A service account with user-management permissions in one organization can improperly access and manipulate users in other organizations on the same Grafana instance via the SCIM API. This issue arises from insecure direct object references. The vulnerability has a CVSS score of 6.7 (medium severity) and affects multiple versions of Grafana Enterprise prior to fixed releases.
ApostropheCMS versions prior to 4.33.0 contain an authorization bypass vulnerability allowing authenticated editors with edit rights on a page to reorder sibling pages under a restricted parent without having create authorization on that parent. This bypass is limited to sibling ordering and does not allow arbitrary content modification, confidentiality loss, or creation of restricted nesting. The issue is fixed in version 4.33.0.
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.
The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.
Exploitation requires an authenticated session but no user interaction.
CVE-2026-112068 is an authorization bypass vulnerability in the TYPO3 Extension "Analytics" backend module. The module fails to verify whether a backend user has access rights to the requested site, allowing users with module access to view the analytics dashboard of any site. This issue affects versions from 0 up to but not including 1.1.1 and is fixed in version 1.1.1.
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.
IBM Langflow OSS versions 1.0.0 through 1.12.4 have an authorization bypass vulnerability due to lack of ownership verification on three message endpoints. Authenticated users can exploit this flaw to bulk-delete other users' messages, overwrite message content with malicious prompts, or hijack conversation sessions by reassigning session IDs.
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.
CVE-2026-110494 is an authorization bypass vulnerability in Gitea affecting versions up to 28.1.0. It allows a user with write access to repository releases to link attachments to releases without proper verification if they know the attachment's UUID. This can expose attachment metadata such as file name, size, and download count, and permits renaming or deletion of the attachment.
A vulnerability in the Modern Events Calendar Lite WordPress plugin before version 7.36.4 allows authenticated users with the Subscriber role to update the title, content, and excerpt of posts, pages, and custom post types created by other users without proper authorization checks.
Tutor LMS plugin for WordPress versions up to and including 4.1.0 contains an authorization bypass vulnerability via the 'ID' parameter. Authenticated users with author-level access or higher can modify courses created by other instructors by exploiting missing validation on a user-controlled key. This allows overwriting course titles, content, status, and reassigning course ownership.