FileGator versions prior to 7.15.0 contain a missing authorization vulnerability in the upload functionality. A low-privileged user with upload permission can exploit the handling of resumable file uploads to access, modify, or delete temporary files belonging to other users within the shared temporary directory. This can lead to unauthorized disclosure, modification, or deletion of transient objects such as pending archives or login rate-limit lockfiles. The vulnerability is fixed in version 7.15.0.
FileGator versions prior to 7.15.0 contain a vulnerability in the batch download functionality that allows an authenticated user with read, download, and batchdownload permissions to access another user's temporary batch archive by using the archive's unique identifier. This occurs because the system does not verify that the requesting session created the archive. Exploitation is limited by the need to obtain a valid archive ID and the archive's limited lifetime. The issue is fixed in version 7.15.0.
CVE-2026-77442 is an authorization bypass vulnerability in the IgnisDa Ryot application prior to version 10.4.0. It allows a low-privileged authenticated user to update another user's integration by supplying their integration ID without proper ownership verification. This can lead to overwriting or disabling the victim's integration configuration. The vulnerability requires knowledge of the victim's integration ID, which is not easily guessable. The issue is fixed in version 10.4.0.
Velociraptor versions prior to 0.77.2 contain a missing authorization vulnerability in the SQLPlugin.Call function. This flaw allows attacker-controlled connection strings to be passed to SQL database connections without enforcing required FILESYSTEM_READ or NETWORK permissions. Exploitation can lead to unauthorized outbound database connections and potential file access, including root-readable files if Velociraptor runs as root. The issue is fixed in version 0.77.2.
CVE-2026-63437 is an authorization bypass vulnerability in Bubka 2FAuth versions prior to 8.0.0. The flaw exists because the recipients() method in the TwoFAccountShareController does not enforce the manageShares authorization policy before listing recipients of shared 2FA accounts. This allows an authenticated user to enumerate recipients and sharing relationships of 2FA accounts owned by other users. The issue is fixed in version 8.0.0.
CVE-2026-63664 is a missing authorization vulnerability in CloudBeaver versions up to 26.1.1. It allows authenticated non-administrative users with access to a shared database connection to perform certain server-side data exports despite an administrator disabling exports globally. This can lead to unauthorized disclosure of database contents that the user can query but is not permitted to export. The vulnerability does not grant additional read privileges beyond what the user already has. The issue is fixed in version 26.1.2 by enforcing the global export restriction consistently.
CVE-2026-103984 is an authorization bypass vulnerability in FreeScout versions prior to 1.8.231 when the limit_user_customer_visibility setting is enabled. It allows a non-admin agent to retrieve unrelated customer profiles by exploiting the load_customer_info AJAX action, which performs insufficient authorization checks. The exposed data can include personal and confidential information such as names, emails, phone numbers, company details, addresses, social profiles, websites, and internal agent notes. This vulnerability is fixed in version 1.8.231.
FreeScout versions prior to 1.8.226 contain a vulnerability where users restricted to assigned conversations can access data from other conversations within the same mailbox. This occurs because the RealtimeConvNewThread function checks only general mailbox access and not conversation-level restrictions. Exploitation allows exposure of sensitive information such as replies, internal notes, recipient addresses, conversation state, assignee data, and attachment details including URLs with valid download tokens. The issue is resolved in version 1.8.226.
Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.
NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.
In JetBrains YouTrack before 2026.2.19562,
2026.1.14137,
2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection
CVE-2026-123323 is a high severity vulnerability in JetBrains YouTrack before version 2025.3.170763. It involves improper URL validation in the app widget host, which allowed apps to send REST requests without requiring user confirmation. This missing authorization flaw could lead to unauthorized actions with high impact on confidentiality, integrity, and availability.
CVE-2026-33379 is a missing authorization vulnerability in Grafana OSS and Grafana Enterprise version 12.4. It allows users with any role, including those with minimal permissions such as Viewer or service accounts with no permissions, to create, externally publish, and delete dashboard snapshots. This issue affects versions from 12.4.0 up to but not including 12.4.4. The vulnerability has been fixed in version 12.4.4.
The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner's Infomaniak API credentials, consume the site owner's VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing public shortcodes to resolve to attacker-chosen video content. This action is explicitly reserved for Contributor-level and above by the plugin's own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.