CVE-2026-16307

IDOR in Netiket Information Technologies' EdoWEB

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netiket Information Technologies

Products

Edoweb

CVE-2026-119748

GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-115334

Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Uselotus

Products

Lotus

CVE-2026-117606

NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Blair2004

Products

Nexopos

CVE-2026-122007

Oqtane Framework before 10.3.0 Broken Access Control via SettingController

Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Oqtane

Products

Oqtane Framework

CVE-2026-121940

Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Stonewuu

Products

Ai-fusion-video

CVE-2026-121937

loonflow before r3.2.3 IDOR via ticket_flow_history Endpoint

loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket_flow_history endpoint, which skips ticket_view_permission_check, to obtain approval comments and processor names, emails and phone numbers.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Loonflow Project

Products

Loonflow

CVE-2026-121583

Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization

A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437).

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Publiccms Sanluan

Products

Publiccms Publiccms

CVE-2026-116810

OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116184

OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Openremote

Products

Core Openremote

CVE-2026-115326

QloApps through 1.7.0 IDOR via OrderDetailController Refund Request

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webkul

Products

Qloapps

CVE-2026-108067

FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110964

Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR

The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-118403

Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Premium Packages

CVE-2026-118407

Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover

The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Premium Packages

CVE-2026-116899

REDAXO before 5.21.4 Broken Access Control in Slice Operations

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-109848

Authorization Bypass in GROWI Tag and Page Update APIs Enabling Unauthorized Access and Modification

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Growi

Products

Growi

CVE-2026-105272

Authorization Bypass in GROWI Page Viewing and Commenting

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Growi

Products

Growi

CVE-2026-118947

Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor

A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more

CVE-2026-34046

Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filter by `user_id`. When `AUTO_LOGIN` was `False` (i.e., authentication was enabled), neither branch enforced an ownership check — the query returned any flow matching the given UUID regardless of who owned it. This allowed any authenticated user to read any other user's flow, including embedded plaintext API keys; modify the logic of another user's AI agents, and/or delete flows belonging to other users. The vulnerability was introduced by the conditional logic that was meant to accommodate public/example flows (those with `user_id = NULL`) under auto-login mode, but inadvertently left the authenticated path without an ownership filter. The fix in version 1.5.1 removes the `AUTO_LOGIN` conditional entirely and unconditionally scopes the query to the requesting user.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Langflow

Products

Langflow Langflow-base