Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2773 vulnerabilities reference this CWE, most recent first.
CVE-2026-120319 (GCVE-0-2026-120319)
Vulnerability from cvelistv5 – Published: 2026-11-02 01:15 – Updated: 2026-11-05 15:59
VLAI
EPSS
VEX
Title
Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization
Summary
A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 15:58 UTC
Assigner
VulDB
CNA
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429652 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/429652/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120319 | third-party-advisory |
| https://vuldb.com/submit/1016201 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120319",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T15:58:52.750887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:59:11.137Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*"
],
"modules": [
"publiccms-trade"
],
"product": "PublicCMS",
"vendor": "Sanluan",
"versions": [
{
"status": "affected",
"version": "4.*"
},
{
"status": "affected",
"version": "5.*"
},
{
"status": "affected",
"version": "6.*"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "s1mple_xy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T01:15:23.883Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429652 | Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429652"
},
{
"name": "VDB-429652 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429652/cti"
},
{
"name": "CVE-2026-120319 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120319"
},
{
"name": "Submit #1016201 | Sanluan publiccms V5 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1016201"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-01T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-01T14:06:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120319",
"datePublished": "2026-11-02T01:15:23.883Z",
"dateReserved": "2026-11-01T13:01:19.496Z",
"dateUpdated": "2026-11-05T15:59:11.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120263 (GCVE-0-2026-120263)
Vulnerability from cvelistv5 – Published: 2026-11-01 09:47 – Updated: 2026-11-06 15:43
VLAI
EPSS
VEX
Title
Gitea OAuth2 account auto-linking takeover through the sign-up form
Summary
When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on a configured OAuth2 provider could submit another user's name, link their external identity to that Gitea account and be signed in as it without its password, including as an administrator. The link persisted for later sign-ins. Automatic linking now only happens when the existing account matches the provider's email or provider-derived user name; otherwise the account password is required.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 15:42 UTC
Assigner
Gitea
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/40121 | patch |
| https://github.com/go-gitea/gitea/pull/40137 | patch |
| https://blog.gitea.com/release-of-28.3.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-120263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:42:41.395164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:43:25.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThan": "28.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/adrian-doyensec"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/AdamKorcz"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/DshtAnger"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/ivantsepp"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
}
],
"descriptions": [
{
"lang": "en",
"value": "When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on a configured OAuth2 provider could submit another user\u0027s name, link their external identity to that Gitea account and be signed in as it without its password, including as an administrator. The link persisted for later sign-ins. Automatic linking now only happens when the existing account matches the provider\u0027s email or provider-derived user name; otherwise the account password is required."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T09:47:09.191Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-8p3x-w464-4g6v",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8p3x-w464-4g6v"
},
{
"name": "Fix: go-gitea/gitea pull request #40121",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/40121"
},
{
"name": "Fix backport to release/v28: go-gitea/gitea pull request #40137",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/40137"
},
{
"name": "Gitea 28.3.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.3.0/"
},
{
"name": "go-gitea/gitea v28.3.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0"
}
],
"title": "Gitea OAuth2 account auto-linking takeover through the sign-up form"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-120263",
"datePublished": "2026-11-01T09:47:09.191Z",
"dateReserved": "2026-11-01T08:48:41.149Z",
"dateUpdated": "2026-11-06T15:43:25.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120200 (GCVE-0-2026-120200)
Vulnerability from cvelistv5 – Published: 2026-10-31 17:25 – Updated: 2026-11-02 17:51
VLAI
EPSS
VEX
Title
Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes
Summary
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:03 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/gnmyt/Nexterm/issues/1944 | issue-tracking |
| https://github.com/gnmyt/Nexterm/pull/1950 | issue-trackingpatch |
| https://github.com/gnmyt/Nexterm/commit/00fdb03ee… | patch |
| https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA… | technical-description |
| https://github.com/gnmyt/Nexterm | product |
| https://www.vulncheck.com/advisories/nexterm-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120200",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:03:44.303344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:51:26.402Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Nexterm",
"repo": "https://github.com/gnmyt/Nexterm",
"vendor": "gnmyt",
"versions": [
{
"lessThanOrEqual": "1.2.2-BETA",
"status": "affected",
"version": "1.0.6-OPEN-PREVIEW",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HieuPenguinnn"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users\u0027 remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T17:25:50.165Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1944",
"tags": [
"issue-tracking"
],
"url": "https://github.com/gnmyt/Nexterm/issues/1944"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/gnmyt/Nexterm/pull/1950"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87"
},
{
"tags": [
"product"
],
"url": "https://github.com/gnmyt/Nexterm"
},
{
"name": "VulnCheck Advisory: Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nexterm-through-1.2.2-beta-missing-authorization-in-server-session-lifecycle-routes"
}
],
"title": "Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120200",
"datePublished": "2026-10-31T17:25:50.165Z",
"dateReserved": "2026-10-31T11:44:46.346Z",
"dateUpdated": "2026-11-02T17:51:26.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120199 (GCVE-0-2026-120199)
Vulnerability from cvelistv5 – Published: 2026-10-31 17:25 – Updated: 2026-11-06 18:50
VLAI
EPSS
VEX
Title
LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API
Summary
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 18:50 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/learnhouse/learnhouse/issues/1184 | issue-tracking |
| https://github.com/learnhouse/learnhouse/commit/8… | patch |
| https://github.com/learnhouse/learnhouse/pull/1187 | issue-trackingpatch |
| https://github.com/learnhouse/learnhouse/blob/1.1… | technical-description |
| https://github.com/learnhouse/learnhouse | product |
| https://www.vulncheck.com/advisories/learnhouse-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| learnhouse | learnhouse |
Affected:
0 , < 1.1.1
(semver)
cpe:2.3:a:learnhouse:learnhouse:*:*:*:*:*:*:*:* |
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120199",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T18:50:21.216121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:50:30.136Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "learnhouse",
"repo": "https://github.com/learnhouse/learnhouse",
"vendor": "learnhouse",
"versions": [
{
"lessThan": "1.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:learnhouse:learnhouse:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HieuPenguinnn"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users\u0027 grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students\u0027 work, grades and instructor feedback."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T17:25:49.528Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1184",
"tags": [
"issue-tracking"
],
"url": "https://github.com/learnhouse/learnhouse/issues/1184"
},
{
"tags": [
"patch"
],
"url": "https://github.com/learnhouse/learnhouse/commit/844a8a7787f0c42d466be604aaf47d296748b1b3"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/learnhouse/learnhouse/pull/1187"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/learnhouse/learnhouse/blob/1.1.0/apps/api/src/services/courses/activities/assignments.py#L1673"
},
{
"tags": [
"product"
],
"url": "https://github.com/learnhouse/learnhouse"
},
{
"name": "VulnCheck Advisory: LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/learnhouse-before-1.1.1-missing-authorization-via-assignment-submissions-api"
}
],
"title": "LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120199",
"datePublished": "2026-10-31T17:25:49.528Z",
"dateReserved": "2026-10-31T11:44:45.958Z",
"dateUpdated": "2026-11-06T18:50:30.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120007 (GCVE-0-2026-120007)
Vulnerability from cvelistv5 – Published: 2026-10-30 18:52 – Updated: 2026-10-30 19:42
VLAI
EPSS
VEX
Title
NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid
Summary
NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 19:42 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/NodeBB/NodeBB/commit/376d14abb… | patch |
| https://github.com/NodeBB/NodeBB/blob/c3d8dc51229… | technical-description |
| https://github.com/NodeBB/NodeBB/blob/c3d8dc51229… | technical-description |
| https://github.com/NodeBB/NodeBB | product |
| https://www.vulncheck.com/advisories/nodebb-1.18.… | third-party-advisory |
Impacted products
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120007",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T19:42:32.089286Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:42:51.208Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/nodebb",
"product": "NodeBB",
"repo": "https://github.com/NodeBB/NodeBB",
"vendor": "NodeBB",
"versions": [
{
"lessThanOrEqual": "4.16.5",
"status": "affected",
"version": "1.18.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.16.5",
"versionStartIncluding": "1.18.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani (AploSec)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "julianlam"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim\u0027s email and confirmation state and revoke all their sessions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:52:57.828Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/NodeBB/NodeBB/commit/376d14abb7fffd8ea14f3a2f96baa20ffee5cdb3"
},
{
"name": "Registration body saved to session (4.16.5)",
"tags": [
"technical-description"
],
"url": "https://github.com/NodeBB/NodeBB/blob/c3d8dc512292a376f19e06cb93512bdff2505102/src/controllers/authentication.js#L34"
},
{
"name": "Email interstitial removal on attacker-chosen uid (4.16.5)",
"tags": [
"technical-description"
],
"url": "https://github.com/NodeBB/NodeBB/blob/c3d8dc512292a376f19e06cb93512bdff2505102/src/user/interstitials.js#L124"
},
{
"tags": [
"product"
],
"url": "https://github.com/NodeBB/NodeBB"
},
{
"name": "VulnCheck Advisory: NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nodebb-1.18.0-through-4.16.5-authorization-bypass-via-register-complete-uid"
}
],
"title": "NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120007",
"datePublished": "2026-10-30T18:52:57.828Z",
"dateReserved": "2026-10-30T17:58:24.242Z",
"dateUpdated": "2026-10-30T19:42:51.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119800 (GCVE-0-2026-119800)
Vulnerability from cvelistv5 – Published: 2026-11-06 21:29 – Updated: 2026-11-09 22:42
VLAI
EPSS
VEX
Title
Ryot: Cross-tenant collection read via `collectionContents`
Summary
Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:35 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/IgnisDa/ryot/security/advisori… | x_refsource_CONFIRM |
| https://github.com/IgnisDa/ryot/pull/1870 | x_refsource_MISC |
| https://github.com/IgnisDa/ryot/commit/822cc6701b… | x_refsource_MISC |
| https://github.com/IgnisDa/ryot/releases/tag/v10.5.6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119800",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:35:16.005330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:42:32.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ryot",
"vendor": "IgnisDa",
"versions": [
{
"status": "affected",
"version": "\u003c 10.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller\u0027s user id is used only to annotate the response, allowing any authenticated user who obtains another collection\u0027s id to read the owner\u0027s identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T21:29:32.910Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v"
},
{
"name": "https://github.com/IgnisDa/ryot/pull/1870",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/IgnisDa/ryot/pull/1870"
},
{
"name": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
},
{
"name": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
}
],
"source": {
"advisory": "GHSA-pv32-9hxm-ph4v",
"discovery": "UNKNOWN"
},
"title": "Ryot: Cross-tenant collection read via `collectionContents`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119800",
"datePublished": "2026-11-06T21:29:32.910Z",
"dateReserved": "2026-10-30T16:28:37.900Z",
"dateUpdated": "2026-11-09T22:42:32.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119759 (GCVE-0-2026-119759)
Vulnerability from cvelistv5 – Published: 2026-11-09 20:29 – Updated: 2026-11-09 20:29 X_Open Source
VLAI
EPSS
VEX
Title
TrailBase 0.28.2 < 0.35.10 IDOR via Record API File Column
Summary
TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers can reference another user's or table's file id in a record they own to read the victim's file bytes through their own record, or trigger permanent deletion of the victim's file by deleting or nulling their own record, while also using a $like filter on the file column to brute-force recover stripped ids character by character.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/trailbaseio/trailbase/releases… | release-notespatch |
| https://www.vulncheck.com/advisories/trailbase-id… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| trailbaseio | trailbase |
Affected:
0.28.2 , < 0.35.10
(semver)
|
Date Public
2026-11-07 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/trailbaseio/trailbase",
"product": "trailbase",
"repo": "https://github.com/trailbaseio/trailbase",
"vendor": "trailbaseio",
"versions": [
{
"lessThan": "0.35.10",
"status": "affected",
"version": "0.28.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tinthid"
}
],
"datePublic": "2026-11-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers can reference another user\u0027s or table\u0027s file id in a record they own to read the victim\u0027s file bytes through their own record, or trigger permanent deletion of the victim\u0027s file by deleting or nulling their own record, while also using a $like filter on the file column to brute-force recover stripped ids character by character."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:29:24.226Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Fixed Release Tag",
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/trailbaseio/trailbase/releases#release-v0.35.10"
},
{
"name": "VulnCheck Advisory: TrailBase 0.28.2 \u003c 0.35.10 IDOR via Record API File Column",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/trailbase-idor-via-record-api-file-column"
}
],
"tags": [
"x_open-source"
],
"title": "TrailBase 0.28.2 \u003c 0.35.10 IDOR via Record API File Column",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119759",
"datePublished": "2026-11-09T20:29:24.226Z",
"dateReserved": "2026-10-30T15:31:52.080Z",
"dateUpdated": "2026-11-09T20:29:24.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119751 (GCVE-0-2026-119751)
Vulnerability from cvelistv5 – Published: 2026-11-05 15:35 – Updated: 2026-11-05 20:41 X_Open Source
VLAI
EPSS
VEX
Title
Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks
Summary
Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:41 UTC
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://wordpress.org/plugins/content-egg/#developers | release-notespatch |
| https://www.vulncheck.com/advisories/content-egg-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| keywordrush | Content Egg – Affiliate Product Importer & Price Comparison |
Affected:
0 , ≤ 12.0.0
(semver)
Unaffected: 12.1.0 (semver) |
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119751",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:41:07.538980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:41:18.417Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Content Egg \u2013 Affiliate Product Importer \u0026 Price Comparison",
"vendor": "keywordrush",
"versions": [
{
"lessThanOrEqual": "12.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "12.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "buiih"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:35:43.017Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "WordPress Changelog",
"tags": [
"release-notes",
"patch"
],
"url": "https://wordpress.org/plugins/content-egg/#developers"
},
{
"name": "VulnCheck Advisory: Content Egg WordPress Plugin \u003c 12.1.0 Unauthenticated Information Disclosure via render-blocks",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/content-egg-wordpress-plugin-unauthenticated-information-disclosure-via-render-blocks"
}
],
"tags": [
"x_open-source"
],
"title": "Content Egg WordPress Plugin \u003c 12.1.0 Unauthenticated Information Disclosure via render-blocks",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119751",
"datePublished": "2026-11-05T15:35:43.017Z",
"dateReserved": "2026-10-30T15:31:52.080Z",
"dateUpdated": "2026-11-05T20:41:18.417Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119748 (GCVE-0-2026-119748)
Vulnerability from cvelistv5 – Published: 2026-11-04 16:51 – Updated: 2026-11-04 20:25 X_Open Source
VLAI
EPSS
VEX
Title
GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice
Summary
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:24 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://wordpress.org/plugins/invoicing/#developers | release-notespatch |
| https://www.vulncheck.com/advisories/getpaid-word… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AyeCode Ltd | Payment forms, Buy now buttons, and Invoicing System | GetPaid |
Affected:
0 , < 2.8.63
(semver)
|
Date Public
2026-10-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119748",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:24:43.578506Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:25:07.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
"vendor": "AyeCode Ltd",
"versions": [
{
"lessThan": "2.8.63",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Idan Malihi"
}
],
"datePublic": "2026-10-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user\u0027s invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T16:51:24.437Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "WordPress Changelog",
"tags": [
"release-notes",
"patch"
],
"url": "https://wordpress.org/plugins/invoicing/#developers"
},
{
"name": "VulnCheck Advisory: GetPaid WordPress Plugin \u003c 2.8.63 Authorization Bypass via maybe_use_invoice",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-authorization-bypass-via-maybe-use-invoice"
}
],
"tags": [
"x_open-source"
],
"title": "GetPaid WordPress Plugin \u003c 2.8.63 Authorization Bypass via maybe_use_invoice",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119748",
"datePublished": "2026-11-04T16:51:24.437Z",
"dateReserved": "2026-10-30T15:31:52.079Z",
"dateUpdated": "2026-11-04T20:25:07.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119734 (GCVE-0-2026-119734)
Vulnerability from cvelistv5 – Published: 2026-11-02 18:58 – Updated: 2026-11-07 02:24 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Munshi IDOR via Purchase Inquiry Thread Endpoint
Summary
Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 02:24 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://medium.com/@TheWildEye/idor-in-munshi-cha… | technical-descriptionexploit |
| https://www.petpooja.com/ | product |
| https://www.vulncheck.com/advisories/munshi-idor-… | third-party-advisory |
Impacted products
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119734",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T02:24:17.435326Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T02:24:27.739Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Munshi",
"vendor": "Petpooja",
"versions": [
{
"lessThanOrEqual": "2026-06-17",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vyom Nagpal"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user\u0027s purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T18:58:31.208Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://medium.com/@TheWildEye/idor-in-munshi-changing-a-purchase-inquiry-id-exposed-another-users-thread-540323a91bf5"
},
{
"name": "Vender Homepage",
"tags": [
"product"
],
"url": "https://www.petpooja.com/"
},
{
"name": "VulnCheck Advisory: Munshi IDOR via Purchase Inquiry Thread Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/munshi-idor-via-purchase-inquiry-thread-endpoint"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Munshi IDOR via Purchase Inquiry Thread Endpoint",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119734",
"datePublished": "2026-11-02T18:58:31.208Z",
"dateReserved": "2026-10-30T15:31:52.078Z",
"dateUpdated": "2026-11-07T02:24:27.739Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.