Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2788 vulnerabilities reference this CWE, most recent first.
CVE-2026-110613 (GCVE-0-2026-110613)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-27 01:30
VLAI
EPSS
VEX
Title
youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List
Summary
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:31 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/youlai-… | third-party-advisory |
| https://github.com/youlaitech/youlai-mall/blob/9f… | technical-description |
| https://github.com/youlaitech/youlai-mall/blob/9f… | technical-description |
| https://github.com/youlaitech/youlai-mall | product |
| https://www.vulncheck.com/advisories/youlai-mall-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| youlaitech | youlai-mall |
Affected:
de86041995fa3a8b1e959b86232cb9f0bf52ff46 , ≤ 9f62de811d478b3ab6b27438efd58e2c4fdb4c31
(git)
cpe:2.3:a:youlai:youlai-mall:-:*:*:*:*:*:*:* |
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110613",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:31:10.870740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:16:28.354Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/youlaitech/youlai-mall",
"product": "youlai-mall",
"repo": "https://github.com/youlaitech/youlai-mall",
"vendor": "youlaitech",
"versions": [
{
"lessThanOrEqual": "9f62de811d478b3ab6b27438efd58e2c4fdb4c31",
"status": "affected",
"version": "de86041995fa3a8b1e959b86232cb9f0bf52ff46",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:youlai:youlai-mall:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer\u0027s orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T01:30:45.127Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/youlai-mall-order-list-cross-member-disclosure"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/youlaitech/youlai-mall/blob/9f62de811d478b3ab6b27438efd58e2c4fdb4c31/mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java#L33-L38"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/youlaitech/youlai-mall/blob/9f62de811d478b3ab6b27438efd58e2c4fdb4c31/mall-oms/oms-boot/src/main/resources/mapper/OmsOrderMapper.xml#L15-L52"
},
{
"tags": [
"product"
],
"url": "https://github.com/youlaitech/youlai-mall"
},
{
"name": "VulnCheck Advisory: youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/youlai-mall-through-commit-9f62de8-order-information-disclosure-via-app-order-list"
}
],
"title": "youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110613",
"datePublished": "2026-10-14T14:16:53.257Z",
"dateReserved": "2026-10-14T13:07:24.553Z",
"dateUpdated": "2026-10-27T01:30:45.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110611 (GCVE-0-2026-110611)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-20 01:10
VLAI
EPSS
VEX
Title
REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid
Summary
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:08 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/getrebu… | third-party-advisory |
| https://github.com/getrebuild/rebuild/blob/48c6cc… | technical-description |
| https://github.com/getrebuild/rebuild/blob/48c6cc… | technical-description |
| https://www.vulncheck.com/advisories/rebuild-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| getrebuild | rebuild |
Affected:
0 , ≤ 4.5.0
(semver)
cpe:2.3:a:getrebuild:rebuild:*:*:*:*:*:*:*:* |
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110611",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:08:37.024887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:10:36.770Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/getrebuild-rebuild-aibot-chat-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/getrebuild/rebuild",
"product": "rebuild",
"repo": "https://github.com/getrebuild/rebuild",
"vendor": "getrebuild",
"versions": [
{
"lessThanOrEqual": "4.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getrebuild:rebuild:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user\u0027s chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:51.948Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/getrebuild-rebuild-aibot-chat-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/getrebuild/rebuild/blob/48c6cc42f9c331cc57c057fa9c66d6cbda990131/src/main/java/com/rebuild/web/aibot/AiBot2Controller.java#L151-L203"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/getrebuild/rebuild/blob/48c6cc42f9c331cc57c057fa9c66d6cbda990131/src/main/java/com/rebuild/core/aibot2/ChatManager.java#L99-L101"
},
{
"name": "VulnCheck Advisory: REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rebuild-through-4.5.0-authorization-bypass-via-aibot2-chat-endpoints-chatid"
}
],
"title": "REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110611",
"datePublished": "2026-10-14T14:16:51.948Z",
"dateReserved": "2026-10-14T13:07:23.861Z",
"dateUpdated": "2026-10-20T01:10:36.770Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110608 (GCVE-0-2026-110608)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-16 17:16
VLAI
EPSS
VEX
Title
BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive
Summary
BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:31 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspri… | third-party-advisory |
| https://github.com/BizSpringSource/bizspring-shop… | technical-description |
| https://github.com/bizspring-open/BizSpring-Java-… | technical-description |
| https://github.com/BizSpringSource/bizspring-shop… | product |
| https://github.com/bizspring-open/BizSpring-Java-Mall | product |
| https://www.vulncheck.com/advisories/bizspring-sh… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| BizSpring | BizSpring Shop |
Affected:
0 , ≤ cf22d39daaf17f430d8fc1fb698a2f6e515e1808
(git)
|
|
| BizSpring | BizSpring Java Mall |
Affected:
0 , ≤ 369e88c5cda36ddcea56742c335ee1bfe50e8156
(git)
|
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:31:08.640481Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:16:36.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/BizSpringSource/bizspring-shop-opensource",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/BizSpringSource/bizspring-shop-opensource",
"product": "BizSpring Shop",
"repo": "https://github.com/BizSpringSource/bizspring-shop-opensource",
"vendor": "BizSpring",
"versions": [
{
"lessThanOrEqual": "cf22d39daaf17f430d8fc1fb698a2f6e515e1808",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
},
{
"collectionURL": "https://github.com/bizspring-open/BizSpring-Java-Mall",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/bizspring-open/BizSpring-Java-Mall",
"product": "BizSpring Java Mall",
"repo": "https://github.com/bizspring-open/BizSpring-Java-Mall",
"vendor": "BizSpring",
"versions": [
{
"lessThanOrEqual": "369e88c5cda36ddcea56742c335ee1bfe50e8156",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members\u0027 orders by supplying their orderId. Attackers can cancel victims\u0027 pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim\u0027s consent."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:49.839Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145"
},
{
"tags": [
"product"
],
"url": "https://github.com/BizSpringSource/bizspring-shop-opensource"
},
{
"tags": [
"product"
],
"url": "https://github.com/bizspring-open/BizSpring-Java-Mall"
},
{
"name": "VulnCheck Advisory: BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bizspring-shop-through-commit-cf22d39daaf1-idor-via-member-order-cancel-and-receive"
}
],
"title": "BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110608",
"datePublished": "2026-10-14T14:16:49.839Z",
"dateReserved": "2026-10-14T13:07:22.907Z",
"dateUpdated": "2026-10-16T17:16:36.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110494 (GCVE-0-2026-110494)
Vulnerability from cvelistv5 – Published: 2026-10-18 18:57 – Updated: 2026-10-19 20:20
VLAI
EPSS
VEX
Title
Gitea release attachment re-linking of issue attachments
Summary
Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 20:20 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Gitea
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39839 | patch |
| https://github.com/go-gitea/gitea/pull/39847 | patch |
| https://blog.gitea.com/release-of-28.2.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.2.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T20:20:54.281465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:20:57.542Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "28.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/manus-pi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/wxiaoguang"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T18:57:26.290Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-cwq7-782w-pxcc",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-cwq7-782w-pxcc"
},
{
"name": "Fix: go-gitea/gitea pull request #39839",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39839"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39847"
},
{
"name": "Gitea 28.2.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.2.0/"
},
{
"name": "go-gitea/gitea v28.2.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.2.0"
}
],
"title": "Gitea release attachment re-linking of issue attachments"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-110494",
"datePublished": "2026-10-18T18:57:26.290Z",
"dateReserved": "2026-10-14T20:08:45.845Z",
"dateUpdated": "2026-10-19T20:20:57.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110467 (GCVE-0-2026-110467)
Vulnerability from cvelistv5 – Published: 2026-10-14 06:31 – Updated: 2026-10-16 15:31
VLAI
EPSS
VEX
Title
WisdomGarden｜Tronclass - Insecure Direct Object Reference
Summary
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:17 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
twcert
CNA
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-11272-91666-1.html | third-party-advisory |
| https://www.twcert.org.tw/en/cp-139-11273-b9383-2.html | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WisdomGarden | Tronclass |
Affected:
1.77
(custom)
Affected: 1.78 (custom) |
Date Public
2026-10-14 06:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110467",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:17:56.346795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:31:52.878Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tronclass",
"vendor": "WisdomGarden",
"versions": [
{
"status": "affected",
"version": "1.77",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.78",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-10-14T06:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student.\u003c/p\u003e"
}
],
"value": "Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T06:31:24.977Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-11272-91666-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-11273-b9383-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePlease update to version 1.77.123590-hotfix or later\u003cbr\u003ePlease update to version 1.78.123589-hotfix or later\u003c/p\u003e"
}
],
"value": "Please update to version 1.77.123590-hotfix or later\nPlease update to version 1.78.123589-hotfix or later"
}
],
"source": {
"advisory": "TVN-202610003",
"discovery": "EXTERNAL"
},
"title": "WisdomGarden\uff5cTronclass - Insecure Direct Object Reference",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2026-110467",
"datePublished": "2026-10-14T06:31:24.977Z",
"dateReserved": "2026-10-14T06:12:30.831Z",
"dateUpdated": "2026-10-16T15:31:52.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110465 (GCVE-0-2026-110465)
Vulnerability from cvelistv5 – Published: 2026-10-14 06:28 – Updated: 2026-10-14 16:01
VLAI
EPSS
VEX
Title
WisdomGarden｜Tronclass - Insecure Direct Object Reference
Summary
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:00 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
twcert
CNA
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-11272-91666-1.html | third-party-advisory |
| https://www.twcert.org.tw/en/cp-139-11273-b9383-2.html | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WisdomGarden | Tronclass |
Affected:
1.77
(custom)
Affected: 1.78 (custom) |
Date Public
2026-10-14 06:27
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110465",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:00:57.090448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:01:23.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tronclass",
"vendor": "WisdomGarden",
"versions": [
{
"status": "affected",
"version": "1.77",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.78",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-10-14T06:27:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student.\u003c/p\u003e"
}
],
"value": "Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T06:28:22.068Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-11272-91666-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-11273-b9383-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePlease update to version 1.77.123590-hotfix or later\u003cbr\u003ePlease update to version 1.78.123589-hotfix or later\u003c/p\u003e"
}
],
"value": "Please update to version 1.77.123590-hotfix or later\nPlease update to version 1.78.123589-hotfix or later"
}
],
"source": {
"advisory": "TVN-202610003",
"discovery": "EXTERNAL"
},
"title": "WisdomGarden\uff5cTronclass - Insecure Direct Object Reference",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2026-110465",
"datePublished": "2026-10-14T06:28:22.068Z",
"dateReserved": "2026-10-14T06:12:28.715Z",
"dateUpdated": "2026-10-14T16:01:23.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110383 (GCVE-0-2026-110383)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:00 – Updated: 2026-10-18 11:42 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability
Summary
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:22 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WP E-Signature | Electronic Signature Add-on for Fluent Forms |
Affected:
0 , ≤ 2.0.5
(custom)
|
Date Public
2026-10-16 10:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:22:44.650844Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:42:55.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "signature-fluent-contract-forms-add-on",
"product": "Electronic Signature Add-on for Fluent Forms",
"vendor": "WP E-Signature",
"versions": [
{
"changes": [
{
"at": "2.0.6",
"status": "unaffected"
}
],
"lessThanOrEqual": "2.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Oly Hossen | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-16T10:37:22.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.\u003c/p\u003e"
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:00:29.114Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/signature-fluent-contract-forms-add-on/vulnerability/wordpress-electronic-signature-add-on-for-fluent-forms-plugin-2-0-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Electronic Signature Add-on for Fluent Forms plugin to the latest available version (at least 2.0.6)."
}
],
"value": "Update the WordPress Electronic Signature Add-on for Fluent Forms plugin to the latest available version (at least 2.0.6)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Electronic Signature Add-on for Fluent Forms plugin \u003c= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-110383",
"datePublished": "2026-10-18T11:00:29.114Z",
"dateReserved": "2026-10-14T00:22:17.450Z",
"dateUpdated": "2026-10-18T11:42:55.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110381 (GCVE-0-2026-110381)
Vulnerability from cvelistv5 – Published: 2026-10-15 17:48 – Updated: 2026-10-16 17:12 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability
Summary
Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:24 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NSquared | Simply Schedule Appointments |
Affected:
0 , ≤ 1.6.12.35
(custom)
|
Date Public
2026-10-15 17:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110381",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:24:49.858482Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:12:29.676Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "simply-schedule-appointments",
"product": "Simply Schedule Appointments",
"vendor": "NSquared",
"versions": [
{
"changes": [
{
"at": "1.6.12.37",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.6.12.35",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ssophiz | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-15T17:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.\u003c/p\u003e"
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T17:49:08.502Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-12-35-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Simply Schedule Appointments plugin to the latest available version (at least 1.6.12.37)."
}
],
"value": "Update the WordPress Simply Schedule Appointments plugin to the latest available version (at least 1.6.12.37)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Simply Schedule Appointments plugin \u003c= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-110381",
"datePublished": "2026-10-15T17:48:07.069Z",
"dateReserved": "2026-10-14T00:22:17.449Z",
"dateUpdated": "2026-10-16T17:12:29.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110238 (GCVE-0-2026-110238)
Vulnerability from cvelistv5 – Published: 2026-10-13 18:50 – Updated: 2026-10-14 16:28
VLAI
EPSS
VEX
Title
Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
Summary
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:27 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/zofe/rapyd-admin/commit/acd6ee… | patch |
| https://github.com/zofe/rapyd-admin/releases/tag/… | release-notes |
| https://github.com/zofe/rapyd-admin/blob/v9.19.0/… | technical-description |
| https://github.com/zofe/rapyd-admin/blob/v9.19.0/… | technical-description |
| https://github.com/zofe/rapyd-admin | product |
| https://www.vulncheck.com/advisories/rapyd-admin-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zofe | rapyd-admin |
Affected:
9.0.0 , < 9.20.0
(semver)
Unaffected: 9.20.0 (semver) |
Date Public
2026-09-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110238",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:27:34.431150Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:28:15.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/zofe/rapyd-admin",
"product": "rapyd-admin",
"repo": "https://github.com/zofe/rapyd-admin",
"vendor": "zofe",
"versions": [
{
"lessThan": "9.20.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "9.20.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hyderpwn"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:50:18.726Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a"
},
{
"name": "rapyd-admin v9.20.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0"
},
{
"name": "Vulnerable code in UsersModalEditEmbed.php",
"tags": [
"technical-description"
],
"url": "https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Livewire/UsersModalEditEmbed.php#L27-L81"
},
{
"name": "Member id dispatches in users_table_embed.blade.php",
"tags": [
"technical-description"
],
"url": "https://github.com/zofe/rapyd-admin/blob/v9.19.0/app/Modules/Companies/Views/users_table_embed.blade.php#L17-L20"
},
{
"tags": [
"product"
],
"url": "https://github.com/zofe/rapyd-admin"
},
{
"name": "VulnCheck Advisory: Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-authorization-bypass-via-usersmodaleditembed-component"
}
],
"title": "Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110238",
"datePublished": "2026-10-13T18:50:18.726Z",
"dateReserved": "2026-10-13T18:00:09.867Z",
"dateUpdated": "2026-10-14T16:28:15.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110226 (GCVE-0-2026-110226)
Vulnerability from cvelistv5 – Published: 2026-10-13 18:50 – Updated: 2026-10-16 22:32
VLAI
EPSS
VEX
Title
QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
Summary
QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 22:32 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
8 references
| URL | Tags |
|---|---|
| https://hackmd.io/@leediay/SyMoELioMx | third-party-advisory |
| https://github.com/Qloapps/QloApps/blob/v1.7.0/co… | technical-description |
| https://github.com/Qloapps/QloApps/blob/v1.7.0/co… | technical-description |
| https://github.com/Qloapps/QloApps/blob/v1.7.0/mo… | technical-description |
| https://github.com/Qloapps/QloApps/pull/1649 | patchissue-tracking |
| https://github.com/Qloapps/QloApps/commit/24ff5f5… | patch |
| https://github.com/Qloapps/QloApps | product |
| https://www.vulncheck.com/advisories/qloapps-thro… | third-party-advisory |
Impacted products
Date Public
2026-01-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110226",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T22:32:37.092953Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T22:32:49.105Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Qloapps/QloApps",
"product": "QloApps",
"repo": "https://github.com/Qloapps/QloApps",
"vendor": "Webkul",
"versions": [
{
"lessThanOrEqual": "1.7.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webkul:qloapps:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-01-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:50:11.477Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@leediay/SyMoELioMx"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminProductsController.php#L3038-L3052"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminProductsController.php#L2362-L2367"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/classes/HotelBranchInformation.php#L488-L496"
},
{
"name": "Pull Request #1649",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Qloapps/QloApps/pull/1649"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/Qloapps/QloApps/commit/24ff5f5e6ba0c7a42c83ce8155b318c3ef8c915d"
},
{
"tags": [
"product"
],
"url": "https://github.com/Qloapps/QloApps"
},
{
"name": "VulnCheck Advisory: QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/qloapps-through-1.7.0-authorization-bypass-via-id-hotel-in-room-type-creation"
}
],
"title": "QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110226",
"datePublished": "2026-10-13T18:50:11.477Z",
"dateReserved": "2026-10-13T17:59:45.437Z",
"dateUpdated": "2026-10-16T22:32:49.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.