CWE-639: Insecure Direct Object Reference vulnerabilities

A vulnerability in the Photo Engine (Media Organizer & Lightroom) WordPress plugin before version 6.6.2 allows users with the Author role and above to delete media synced by other users, including administrators, without proper authorization checks.

The iChart WordPress plugin versions before 2.2.4 contain an authorization bypass vulnerability due to missing capability and ownership checks in several AJAX actions. The plugin relies solely on a nonce accessible to any logged-in user, allowing users with minimal privileges (Subscriber role) to read, modify, delete arbitrary posts, and overwrite a site-wide option. This flaw is fixed in version 2.2.4.

The Schema & Structured Data for WP & AMP WordPress plugin before version 1.70 contains an authorization bypass vulnerability. This flaw allows users with the Contributor role or higher, who have been granted access to the plugin, to modify structured data settings of posts they do not own. The vulnerability arises because the plugin does not verify whether a user has permission to edit a post before allowing changes to its structured data. This issue is fixed in version 1.70.

CVE-2026-118241 is an authorization bypass vulnerability in the Smush WordPress plugin versions before 4.3.6. The plugin fails to verify that a user is authorized to act on a targeted media attachment, only checking a broad upload-files capability. This allows users with the Author role and above to optimize and restore media attachments owned by other users, potentially altering files on disk and consuming stored backups.

The Data Tables Generator by Supsystic WordPress plugin versions before 1.15.8 contains an authorization bypass vulnerability. It does not verify user authorization or ownership before returning stored table contents, relying solely on a nonce that is exposed to all visitors. This allows unauthenticated users to access the full contents of any table by its identifier, including unpublished tables.

BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data.

Winter CMS versions from 1.2.13 up to but not including 1.2.14 have an authorization bypass vulnerability in the Backend\Controllers\MyAccount controller. Authenticated backend users can access profile data of other users by specifying their user ID in certain controller actions. The exposed data includes name, login, email, avatar, role, group membership, superuser status, and throttle state, but not password material. This issue is fixed in version 1.2.14.

HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessable identifier from another workspace in the same organization can read sessions, conversation turns, files, traces, and responses, overwrite files, cancel or delete sessions, and publish share links. The issue does not cross organization boundaries, and console users, organization keys, and Default Workspace keys intentionally retain organization-wide access. This issue is fixed in version 0.31.7.

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Authorization bypass through user-controlled key in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Improper access control in Windows NTFS allows an authorized attacker to perform tampering locally.

Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.

Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to manage saved searches in their own organization to read, modify or delete another organization's saved-search alerts and change their recipients, given the alert's identifier, and to create alerts attributed to another organization. Flock remediated the issue in the hosted service on 2026-09-28; no customer action is required.

CVE-2026-120730 is an authorization bypass vulnerability in nerves_hub_web affecting versions from 1.0.0 up to but not including 2.5.3. It allows an authenticated user with device management privileges in one organization to write data into other organizations by manipulating org_id, product_id, and deployment_id fields in device API requests and forms. Although the user cannot control devices already belonging to other organizations or upload firmware to them, devices can be placed into another organization's deployment group or product, causing them to receive that organization's firmware. The issue is fixed in version 2.5.3.

An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially triggering traffic on other systems and email alerts. This can result in some loss of availability due to higher system loads.

SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system users. Successful exploitation results in a high impact on confidentiality, with no impact on integrity or availability of the application.

Temporal Server versions up to 1.29.7, and certain 1.30.x and 1.31.x releases, contain an authorization bypass vulnerability in workflow-history pagination. The server does not bind pagination tokens to the namespace and workflow named in the request, allowing an authenticated caller with read permission on one namespace to access workflow history from another namespace if the history shard matches. This flaw is due to unauthenticated pagination tokens lacking namespace or workflow identity binding. Fixed versions add validation checks and logging to detect and prevent this bypass.

CVE-2026-123800 is a critical authorization bypass vulnerability in SuperTokens Core affecting multiple versions from 6.0.0 up to but not including various fixed releases. The flaw allows an attacker with a valid API key for one application in a licensed multi-tenant deployment to update the parent connection URI domain and manipulate sibling application keys and user sessions. This can lead to unauthorized access, modification of user data, persistence establishment, and denial of service to sibling applications. The issue is fixed in versions including 12.3.1, 12.2.1, 12.1.2, 12.0.11, 11.4.8, 11.3.8, 11.2.4, 11.1.4, 11.0.9, and 10.1.9.

The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash is disabled.