CVE-2025-20114

Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability

A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Unified Contact Center Express Unified Intelligence Center

CVE-2026-117028

Unauthorized Student Result Disclosure via Incorrect Access Control in Skuul 2.6.5

Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, including examination marks, without authorization.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Yungifez

Products

Skuul School Management System

CVE-2026-120333

Broken Access Control in extension "Frontend User Registration" (sf_register)

The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension "frontend User Registration"

CVE-2026-120328

Information Disclosure in extension "Mail" (mail)

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Mail

CVE-2026-119732

Munshi Broken Object Level Authorization via Invoice Deletion API

Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Petpooja

Products

Munshi

CVE-2026-115295

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-115292

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-119215

AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Team-alembic

Products

Ash Authentication

CVE-2026-121556

FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Beecue

Products

Fastbee

CVE-2026-106677

Insecure Direct Object Reference in Homestay3 Chat Service

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Homestay3

Products

Homestay-backend

CVE-2026-63401

Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization's users' access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller's organization. The attacker could not read the other organization's queues or jobs, so this issue did not disclose confidential data. This issue is fixed in version 1.0.2.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Roostorg

Products

Coop

CVE-2026-120200

Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gnmyt

Products

Nexterm

CVE-2026-120425

Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint

Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Munafio

Products

Chatify

CVE-2026-118760

Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kubeflow

Products

Pipelines

CVE-2026-107366

Langflow OSS Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-92809

PrestaShop psgdpr through 1.4.3 GDPR Log Forgery

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Prestashop

Products

Prestashop Psgdpr

CVE-2026-119573

Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Traefik

Products

Traefik

CVE-2026-117574

Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Openshift Ai (rhoai) Openshift Ai

CVE-2026-108046

Direct Object Reference (IDOR) vulnerability in Alosuite

Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, resulting in the unauthorized disclosure of application data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Am System

Products

Alo Suite

CVE-2026-17527

Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone

In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Container Native Virtualization Openshift Virtualization