CVE-2026-114214

Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination's policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship. This issue affects ash: from 3.24.0 before 3.37.1.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Ash-project

Products

Ash

CVE-2026-111169

La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation

La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another document's thread without access.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Suitenumerique

Products

Docs

CVE-2026-114742

WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-97255

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94295

Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature

The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-114741

WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-63003

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Django-cms

Products

Django Cms

CVE-2026-46408

Vvveb: checkout IDOR allows unauthorized reuse of another user's cart

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another user's cart data in their own checkout session. This vulnerability is fixed in 1.0.8.3.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Givanz

Products

Vvveb

CVE-2026-109194

Quay: build trigger uuid idor in quay api

A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build triggers and associated write tokens of another repository if they know the victim trigger's universally unique identifier (UUID).

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Quay 3 Quay Red Hat Quay 3

CVE-2026-53903

Insecure Direct Object Reference in MCO

MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validate whether an authenticated user is authorized to access a requested document, allowing direct retrieval based on a user-supplied identifier. An attacker can access trading documents belonging to other users by providing a valid document ID. Although exploitation requires guessing the identifier, predictable ID patterns enable feasible enumeration, leading to unauthorized disclosure of sensitive information. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mycomplianceoffice

Products

Mco Mycomplianceoffice

CVE-2026-52841

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the session, and `oauth_callback` saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data. Version 1.6.0 patches the issue.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Alextselegidis

Products

Easyappointments

CVE-2026-113489

GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-17570

PAM Password History API Allows Credential Disclosure via Improper Access Control

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Devolutions

Products

Devolutions Server Server

CVE-2026-110381

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nsquared Wordpress-extensions

Products

Simply Schedule Appointments Simply Schedule Appointments

CVE-2026-85571

Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR

The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Tutor Lms

CVE-2026-109296

Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openwebui

Products

Open Webui

CVE-2026-109287

Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Open-webui Openwebui

Products

Open-webui Open Webui

CVE-2026-111608

Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Jeequan

Products

Jeepay

CVE-2026-111603

PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints

PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Playeduos

Products

Playedu

CVE-2026-111658

SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API

SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Siteserver Sscms

Products

Sscms Sscms