Base de CVEs

CVE-2026-42515 Alta · 7.1 CWE-639 29/04/2026

Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS

This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.

CVE-2026-41649 Alta · 7.7 CWE-639 28/04/2026

Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces

Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, completely ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents belonging to other workspaces. The full document contents can then be retrieved via the `documents.info` endpoint. Version 1.7.0 contains a patch.

CVE-2026-41406 Média · 5.4 CWE-639 28/04/2026

OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fetched quoted, root, and thread context messages to bypass sender allowlist restrictions and retrieve unauthorized content.

CVE-2026-24178 Crítica · 9.8 CWE-639 28/04/2026

Bypass de autorização via chave controlada pelo usuário no NVIDIA NVFlare Dashboard

A NVIDIA NVFlare Dashboard contém uma vulnerabilidade no sistema de gerenciamento de usuários e autenticação, na qual um atacante não autenticado pode causar bypass de autorização por meio de chave controlada pelo usuário. Uma exploração bem-sucedida desta vulnerabilidade pode levar a escalonamento de privilégios, adulteração de dados, divulgação de informações, execução de código e negação de serviço.

CVE-2026-41372 Média · 5.8 CWE-639 27/04/2026

OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery

OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget authenticated browser control toward localhost endpoints and expose browser state.

CVE-2026-28747 Alta · 7.1 CWE-639 27/04/2026

Milesight Cameras Authorization Bypass Through User-Controlled Key

A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.

CVE-2025-15626 Média · 5.3 CWE-639 27/04/2026

Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application

CVE-2026-6810 Média · 5.3 CWE-639 24/04/2026

Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dex_bccf_admin_int_calendar_list.inc.php file due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to takeover other user's calendars and view user data associated with the calendar.

CVE-2026-2028 Média · 5.3 CWE-639 24/04/2026

Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter

The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxi_remove_custom_image_size' AJAX action in all versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files in the wp-content/uploads directory, including files uploaded by other users and administrators.

CVE-2026-31956 Média · 4.3 CWE-639 23/04/2026

Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authenticated user can manually construct a URL to preview campaigns/regions, and export saved reports belonging to other users. Exploitation of the vulnerability is possible on behalf of an authorized user who has any of the following privileges: Page which shows all Layouts that have been created for the purposes of Layout Management; page which shows all Campaigns that have been created for the purposes of Campaign Management; and page which shows all Reports that have been Saved. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate.

CVE-2026-6375 Alta · 8.7 CWE-639 23/04/2026

Authorization bypass through User-Controlled key in SpiceJet Online Booking System

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw stems from missing authorization checks on an endpoint intended for authenticated profile access.

CVE-2026-41279 Alta · 7.5 CWE-639 23/04/2026

Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted (no auth) and accepts a credentialId directly in the request body. When called without a chatflowId, the endpoint uses the provided credentialId to decrypt the stored credential (e.g., OpenAI or ElevenLabs API key) and generate speech. This vulnerability is fixed in 3.1.0.

CVE-2026-41267 Crítica · 9.8 CWE-639 23/04/2026

Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON injection) vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objects during account creation. This enables client-controlled manipulation of ownership metadata, timestamps, organization association, and role mappings, breaking trust boundaries in a multi-tenant environment. This vulnerability is fixed in 3.1.0.

CVE-2025-66286 Média · 4.7 CWE-639 23/04/2026

Webkitgtk: authorization bypass through webpage::send-request signal handler

An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler.

CVE-2018-25270 Crítica · 9.8 CWE-639 22/04/2026

ThinkPHP 5.0.23 Remote Code Execution via invokefunction

ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.

CVE-2026-6355 Média · 6.5 CWE-639 22/04/2026

CVE-2026-6355

A vulnerability in the web application allows unauthorized users to access and manipulate sensitive data across different tenants by exploiting insecure direct object references. This could lead to unauthorized access to sensitive information and unauthorized changes to the tenant's configuration.

CVE-2026-5750 Alta · 7.6 CWE-639 22/04/2026

Insecure direct object reference (IDOR) vulnerability in Fullstep

An insecure direct object reference (IDOR) vulnerability in the Fullstep V5 registration process allows authenticated users to access data belonging to other registered users through various vulnerable authenticated resources in the application. The vulnerable endpoints result from: '/api/suppliers/v1/suppliers//false' to list user information; and '/#/supplier-registration/supplier-registration//2' to update your user information (personal details, documents, etc.).

CVE-2026-41127 Média · 6.5 CWE-639 21/04/2026

BigBlueButton's missing authorization allows viewer to inject/overwrite captions

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have a missing authorization that allows viewers to inject/overwrite captions Version 3.0.24 tightened the permissions on who is able to submit captions. No known workarounds are available.

CVE-2026-5845 Crítica · 9.6 CWE-639 21/04/2026

Falha de fallback de autorização em tokens user-to-server com escopo no GitHub Enterprise Server

Uma vulnerabilidade de autorização inadequada na autorização de tokens user-to-server com escopo (ghu_) no GitHub Enterprise Server permite que um atacante autenticado acesse repositórios privados fora do escopo de instalação pretendido, o que pode incluir operações de escrita, por meio de um fallback de autorização que tratava uma instalação revogada/excluída como um contexto de instalação global, o que poderia ser combinado com o momento da revogação do token e a atribuição de push via SSH para obter e reutilizar um token com escopo da vítima. Esta vulnerabilidade afetou todas as versões do GitHub Enterprise Server anteriores à 3.21 e foi corrigida nas versões 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21 e 3.14.26. Esta vulnerabilidade foi reportada por meio do programa de bug bounty do GitHub.

CVE-2026-3307 Baixa · 2.7 CWE-639 21/04/2026

Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner_id parameter in the request body. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The impact is limited to assigning existing trusted users as bypass reviewers; it does not allow adding arbitrary external users. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4 and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.

CVE-2026-40907 Média · 6.5 CWE-639 21/04/2026

WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint `plugin/Live/view/Live_restreams/list.json.php` contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user with streaming permission to retrieve other users' live restream configurations, including third-party platform stream keys and OAuth tokens (access_token, refresh_token) for services like YouTube Live, Facebook Live, and Twitch. Commit d5992fff2811df4adad1d9fc7d0a5837b882aed7 fixes the issue.

CVE-2026-5652 Crítica · 9.0 CWE-639 21/04/2026

Bypass de autorização por IDOR na API de usuários do Crafty Controller (CWE-639)

Uma vulnerabilidade de referência direta insegura a objeto no componente Users API do Crafty Controller permite que um atacante remoto e autenticado realize ações de modificação de usuários por meio de validação imprópria de permissões da API.

CVE-2026-40591 Alta · 7.1 CWE-639 21/04/2026

FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the phone-conversation creation flow accepts attacker-controlled `customer_id`, `name`, `to_email`, and `phone` values and resolves the target customer in the backend without enforcing mailbox-scoped customer visibility. As a result, a low-privileged agent who can create a phone conversation in Mailbox A can bind the new Mailbox A phone conversation to a hidden customer from Mailbox B and add a new alias email to that hidden customer record by supplying `to_email`. Version 1.8.214 fixes the vulnerability.

CVE-2026-40590 Média · 4.3 CWE-639 21/04/2026

FreeScout's Customer AJAX Create Modifies Hidden Existing Customer

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the Change Customer modal exposes a “Create a new customer” flow via POST /customers/ajax with action=create. Under limited visibility, the endpoint drops unique-email validation. If the supplied email already belongs to a hidden customer, Customer::create() reuses that hidden customer object and fills empty profile fields from attacker-controlled input. Version 1.8.214 fixes the vulnerability.

CVE-2026-40589 Alta · 7.6 CWE-639 21/04/2026

FreeScout has Customer Edit Cross-Mailbox Email Takeover

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, a low-privileged agent can edit a visible customer and add an email address already owned by a hidden customer in another mailbox. The server discloses the hidden customer’s name and profile URL in the success flash, reassigns the hidden email to the visible customer, and rebinds hidden-mailbox conversations for that email to the visible customer. Version 1.8.214 fixes the issue.