CVE-2026-111672

Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Data-infra

Products

Cube-studio

CVE-2026-111695

Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Shaiwz

Products

Data-platform-open

CVE-2026-111697

HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Roinli

Products

Huizhi-chargeos-cloud

CVE-2026-111698

HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Roinli

Products

Huizhi-chargeos-cloud

CVE-2026-111702

ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Sugarforever

Products

Chat-ollama

CVE-2026-111707

99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Vastxie

Products

99ai

CVE-2026-111709

WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canove

Products

Whaticket-community

CVE-2026-111715

Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API

Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nduckmink

Products

Arkon

CVE-2026-111716

Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nduckmink

Products

Arkon

CVE-2026-111717

Arkon through 0.9.2 Missing Authorization via Skills Versions API

Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nduckmink

Products

Arkon

CVE-2026-116015

yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint

yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yunaiv

Products

Yudao-cloud

CVE-2026-115803

Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization

A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Scada-lts

Products

Scada-lts

CVE-2026-43883

WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying that the authenticated user owns the agreement. A low-privilege authenticated user who learns or obtains another user's PayPal billing agreement ID can silently suspend the victim's recurring subscription, causing revenue loss to the platform and loss of paid service to the victim. Commit 0da3dcff1eda2f497694bf82b559829471c292c2 contains an updated fix.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-116187

Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Rclone

Products

Rclone

CVE-2026-116183

phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq Thorsten

Products

Phpmyfaq Phpmyfaq

CVE-2026-116068

Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-110620

Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Formbricks

Products

Formbricks

CVE-2026-109176

MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mogublog Project

Products

Mogublog

CVE-2026-109164

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tduckcloud

Products

Tduck-survey-form

CVE-2026-96581

An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own. This issue affects ash: from 1.22.0 before 3.37.2.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Ash-project

Products

Ash