Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

2771 vulnerabilities reference this CWE, most recent first.

CVE-2026-125387 (GCVE-0-2026-125387)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController
Summary
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
faveosuite faveo-helpdesk Affected: 0 , ≤ 2.0.3 (custom)
    cpe:2.3:a:ladybirdweb:faveo_helpdesk:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-22 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "faveo-helpdesk",
          "vendor": "faveosuite",
          "versions": [
            {
              "lessThanOrEqual": "2.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ladybirdweb:faveo_helpdesk:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.0.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments\u0027 tickets and enumerate customers\u0027 ticket subjects."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:53.816Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #8368",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/faveosuite/faveo-helpdesk/issues/8368"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/faveosuite/faveo-helpdesk"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L2230-L2300"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/faveosuite/faveo-helpdesk/commit/487a2c33912d701fc04bdb857775fea122ce20d1"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/faveosuite/faveo-helpdesk/commit/70faee621b5c3c88a34e79ad2eb1f0be17e63078"
        },
        {
          "name": "VulnCheck Advisory: Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/faveo-helpdesk-through-2.0.3-cross-department-ticket-tampering-via-ticketcontroller"
        }
      ],
      "title": "Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125387",
    "datePublished": "2026-11-09T23:27:53.816Z",
    "dateReserved": "2026-11-09T22:03:10.249Z",
    "dateUpdated": "2026-11-09T23:27:53.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125386 (GCVE-0-2026-125386)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
langchain4j-aideepin through 3.32.0 IDOR via /character/message reference endpoints
Summary
langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to missing owner checks. Attackers can supply another user's message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints to retrieve knowledge-base chunks, long-term memory text, and knowledge-graph data.
Severity
6 (Medium)
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
moyangzhan langchain4j-aideepin Affected: 0 , ≤ 3.32.0 (semver)
Create a notification for this product.
Date Public
2026-11-04 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "langchain4j-aideepin",
          "vendor": "moyangzhan",
          "versions": [
            {
              "lessThanOrEqual": "3.32.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-11-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users\u0027 message references due to missing owner checks. Attackers can supply another user\u0027s message uuid to the knowledge-embedding-ref, memory-embedding-ref, or graph-ref endpoints to retrieve knowledge-base chunks, long-term memory text, and knowledge-graph data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:53.127Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #118",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/moyangzhan/langchain4j-aideepin/issues/118"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/moyangzhan/langchain4j-aideepin"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/moyangzhan/langchain4j-aideepin/blob/v3.32.0/server/adi-common/src/main/resources/mapper/CharacterMessageRefMemoryEmbeddingMapper.xml#L4-L10"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/moyangzhan/langchain4j-aideepin/commit/483499b1a6b4a27d856f85d88c28ae6152660953"
        },
        {
          "name": "VulnCheck Advisory: langchain4j-aideepin through 3.32.0 IDOR via /character/message reference endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/langchain4j-aideepin-through-3.32.0-idor-via-character-message-reference-endpoints"
        }
      ],
      "title": "langchain4j-aideepin through 3.32.0 IDOR via /character/message reference endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125386",
    "datePublished": "2026-11-09T23:27:53.127Z",
    "dateReserved": "2026-11-09T22:03:09.881Z",
    "dateUpdated": "2026-11-09T23:27:53.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125379 (GCVE-0-2026-125379)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
Movim through 0.35.5 Authorization Bypass via Post::ajaxGetPost Cached Post Read
Summary
Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or contact-only posts from the pod-wide cache before the XMPP authorization check runs.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
movim movim Affected: 0 , ≤ 0.35.5 (custom)
    cpe:2.3:a:movim:movim:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-11-06 00:00
Credits
hieuPenguinnn Timothée Jaussoin
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "movim",
          "vendor": "movim",
          "versions": [
            {
              "lessThanOrEqual": "0.35.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:movim:movim:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.35.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Timoth\u00e9e Jaussoin"
        }
      ],
      "datePublic": "2026-11-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or contact-only posts from the pod-wide cache before the XMPP authorization check runs."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:48.240Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/movim/movim/commit/378e0368368d0dd9cb090b78e68a63064d47d512"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/movim/movim"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/movim/movim/blob/v0.35.5/app/Widgets/Post/Post.php#L126-L160"
        },
        {
          "name": "VulnCheck Advisory: Movim through 0.35.5 Authorization Bypass via Post::ajaxGetPost Cached Post Read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/movim-through-0.35.5-authorization-bypass-via-post-ajaxgetpost-cached-post-read"
        }
      ],
      "title": "Movim through 0.35.5 Authorization Bypass via Post::ajaxGetPost Cached Post Read",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125379",
    "datePublished": "2026-11-09T23:27:48.240Z",
    "dateReserved": "2026-11-09T22:03:07.246Z",
    "dateUpdated": "2026-11-09T23:27:48.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125375 (GCVE-0-2026-125375)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlers
Summary
MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning any project can reparent and reorder documents by sequential ID and set their status to draft or removed, hiding published documents.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
zmister2016 MrDoc Affected: 0 , ≤ 1.1.1 (custom)
    cpe:2.3:a:mrdoc:mrdoc:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-11-03 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MrDoc",
          "vendor": "zmister2016",
          "versions": [
            {
              "lessThanOrEqual": "1.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mrdoc:mrdoc:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.1.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users\u0027 documents by supplying arbitrary document IDs in sort_data. Attackers owning any project can reparent and reorder documents by sequential ID and set their status to draft or removed, hiding published documents."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:45.405Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #209",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/zmister2016/MrDoc/issues/209"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/zmister2016/MrDoc"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/zmister2016/MrDoc/blob/40e43bbdf10502930effd7efbdf5887435cbd148/app_doc/views_import.py#L189-L224"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zmister2016/MrDoc/commit/e2c26d7858289601dde331b205b82ea5e2d2dad1"
        },
        {
          "name": "VulnCheck Advisory: MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlers",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mrdoc-through-1.1.1-missing-authorization-via-project-document-sort-handlers"
        }
      ],
      "title": "MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlers",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125375",
    "datePublished": "2026-11-09T23:27:45.405Z",
    "dateReserved": "2026-11-09T22:03:05.771Z",
    "dateUpdated": "2026-11-09T23:27:45.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125374 (GCVE-0-2026-125374)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detach
Summary
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
krayin laravel-crm Affected: 0 , < 2.2.8 (semver)
Create a notification for this product.
Date Public
2026-11-05 00:00
Credits
hieuPenguinnn Vikas Vishwakarma
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/krayin/laravel-crm",
          "product": "laravel-crm",
          "vendor": "krayin",
          "versions": [
            {
              "lessThan": "2.2.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Vikas Vishwakarma"
        }
      ],
      "datePublic": "2026-11-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:44.695Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/krayin/laravel-crm/commit/3cfa2f763563723469dd1cb7ab53e51b269139bc"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/krayin/laravel-crm"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/krayin/laravel-crm/blob/999b596d0f53cb11c9b029f733a1d67e01fccda6/packages/Webkul/Admin/src/Http/Controllers/Lead/TagController.php#L26-L55"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/krayin/laravel-crm/commit/95e0dbc83a72933aeaf72190a0f570ea1ddcc452"
        },
        {
          "name": "laravel-crm v2.2.8 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/krayin/laravel-crm/releases/tag/v2.2.8"
        },
        {
          "name": "VulnCheck Advisory: Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detach",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/krayin-crm-before-2.2.8-broken-object-level-authorization-via-lead-tag-attach-detach"
        }
      ],
      "title": "Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detach",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125374",
    "datePublished": "2026-11-09T23:27:44.695Z",
    "dateReserved": "2026-11-09T22:03:05.404Z",
    "dateUpdated": "2026-11-09T23:27:44.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125373 (GCVE-0-2026-125373)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Views
Summary
IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
ietf-tools datatracker Affected: 0 , < 12.83.0 (semver)
Create a notification for this product.
Date Public
2026-11-05 00:00
Credits
hieuPenguinnn Robert Sparks
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "datatracker",
          "vendor": "ietf-tools",
          "versions": [
            {
              "lessThan": "12.83.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Robert Sparks"
        }
      ],
      "datePublic": "2026-11-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees\u0027 records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:44.005Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ietf-tools/datatracker/commit/f5bed82fee83d1dc28d89e15856fd329719ebda2"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/ietf-tools/datatracker"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/ietf-tools/datatracker/blob/3aa2f63af2b0198928e36db42203f55cfea53fbd/ietf/nomcom/views.py#L1001-L1010"
        },
        {
          "name": "datatracker v12.83.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/ietf-tools/datatracker/releases/tag/12.83.0"
        },
        {
          "name": "VulnCheck Advisory: IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Views",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ietf-datatracker-before-12.83.0-cross-nomcom-authorization-bypass-via-nomcom-views"
        }
      ],
      "title": "IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Views",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125373",
    "datePublished": "2026-11-09T23:27:44.005Z",
    "dateReserved": "2026-11-09T22:03:05.039Z",
    "dateUpdated": "2026-11-09T23:27:44.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125372 (GCVE-0-2026-125372)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpoints
Summary
REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
getrebuild rebuild Affected: 0 , < 4.5.3 (semver)
    cpe:2.3:a:getrebuild:rebuild:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-22 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "rebuild",
          "vendor": "getrebuild",
          "versions": [
            {
              "lessThan": "4.5.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getrebuild:rebuild:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:43.313Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #1139",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/getrebuild/rebuild/issues/1139"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/getrebuild/rebuild"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/getrebuild/rebuild/blob/af00afcc22476b889c06c3db6032fd94a1454cfa/src/main/java/com/rebuild/web/feeds/FeedsListController.java#L190-L194"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/getrebuild/rebuild/commit/03959a464164e12e87443c689043ceccf56044f3"
        },
        {
          "name": "rebuild v4.5.3 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/getrebuild/rebuild/releases/tag/4.5.3"
        },
        {
          "name": "VulnCheck Advisory: REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rebuild-before-4.5.3-authorization-bypass-via-feeds-details-and-comments-endpoints"
        }
      ],
      "title": "REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125372",
    "datePublished": "2026-11-09T23:27:43.313Z",
    "dateReserved": "2026-11-09T22:03:04.685Z",
    "dateUpdated": "2026-11-09T23:27:43.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125369 (GCVE-0-2026-125369)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookups
Summary
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
fsinfuhh Bitpoll Affected: 0 , ≤ 0.11.0 (semver)
Create a notification for this product.
Date Public
2026-11-05 00:00
Credits
George Chen
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Bitpoll",
          "vendor": "fsinfuhh",
          "versions": [
            {
              "lessThanOrEqual": "0.11.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-11-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:41.257Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #206",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/fsinfuhh/Bitpoll/issues/206"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/fsinfuhh/Bitpoll"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/fsinfuhh/Bitpoll/blob/0.11.0/bitpoll/poll/views.py#L994"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/fsinfuhh/Bitpoll/commit/71013d36a4d587e672eba225d94f7b94cd412ef9"
        },
        {
          "name": "VulnCheck Advisory: Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookups",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/bitpoll-through-0.11.0-unauthenticated-vote-and-comment-disclosure-via-unscoped-lookups"
        }
      ],
      "title": "Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookups",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125369",
    "datePublished": "2026-11-09T23:27:41.257Z",
    "dateReserved": "2026-11-09T22:03:03.581Z",
    "dateUpdated": "2026-11-09T23:27:41.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125365 (GCVE-0-2026-125365)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27 Unsupported When Assigned
VLAI
Title
DollarDollar through 4.4 Missing Authorization in /add_expense Balance Tampering
Summary
DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
harung1993 dollardollar Affected: 0 , ≤ 4.4 (custom)
Create a notification for this product.
Date Public
2026-11-07 00:00
Credits
George Chen
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "dollardollar",
          "vendor": "harung1993",
          "versions": [
            {
              "lessThanOrEqual": "4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-11-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users\u0027 account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:37.786Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #125",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/harung1993/dollardollar/issues/125"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/harung1993/dollardollar"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/harung1993/dollardollar/blob/v4.4/app.py#L4298"
        },
        {
          "name": "VulnCheck Advisory: DollarDollar through 4.4 Missing Authorization in /add_expense Balance Tampering",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dollardollar-through-4.4-missing-authorization-in-add-expense-balance-tampering"
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "DollarDollar through 4.4 Missing Authorization in /add_expense Balance Tampering",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125365",
    "datePublished": "2026-11-09T23:27:37.786Z",
    "dateReserved": "2026-11-09T22:03:02.055Z",
    "dateUpdated": "2026-11-09T23:27:37.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124551 (GCVE-0-2026-124551)

Vulnerability from cvelistv5 – Published: 2026-11-08 13:52 – Updated: 2026-11-08 13:52
VLAI
Title
ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint
Summary
ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.
Severity
6 (Medium)
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
classroomio classroomio Affected: 0 , ≤ 1.0.0 (semver)
    cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-22 00:00
Credits
hieuPenguinnn Rotimi Best
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/classroomio/classroomio",
          "product": "classroomio",
          "vendor": "classroomio",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Rotimi Best"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants\u0027 courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:52:34.322Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #1414",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/classroomio/classroomio/issues/1414"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/classroomio/classroomio"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltration"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/course.ts#L584-L612"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/services/course/clone.ts#L202-L290"
        },
        {
          "name": "VulnCheck Advisory: ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/classroomio-through-1.0.0-cross-organization-course-disclosure-via-clone-endpoint"
        }
      ],
      "title": "ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124551",
    "datePublished": "2026-11-08T13:52:34.322Z",
    "dateReserved": "2026-11-08T13:43:23.426Z",
    "dateUpdated": "2026-11-08T13:52:34.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list