CVE-2026-112068

Insecure Direct Object Reference in extension "Analytics" (analytics)

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Analytics

CVE-2026-9589

Unblu Spark Authorization Bypass in Configuration Cascade Operations

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope. Exploitation requires an authenticated session but no user interaction.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Unblu

Products

Spark

CVE-2026-113603

x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource

The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

X402-foundation

Products

X402

CVE-2026-114394

Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Trudesk Project

Products

Trudesk

CVE-2026-114389

Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Chamilo

Products

Chamilo Lms

CVE-2026-113598

Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Modoboa

Products

Modoboa

CVE-2026-113359

Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Baserow

Products

Baserow

CVE-2026-114395

Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Trudesk Project

Products

Trudesk

CVE-2026-104684

Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Envira Gallery

CVE-2026-104681

Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field

The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Envira Gallery

CVE-2026-111947

Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication

The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110514

WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-111609

PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Openjournalsystems

Products

Open Journal Systems

CVE-2026-111359

CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift

CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Crmeb

Products

Crmeb

CVE-2026-111348

Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Likeshop

Products

Likeshop

CVE-2026-113655

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The non-default nesting must already exist, and the bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting. This issue is fixed in version 4.33.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apostrophecms

Products

Apostrophecms

CVE-2026-92539

Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Enterprise

CVE-2026-113643

EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Espocrm

Products

Espocrm

CVE-2026-111767

MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Modelcontextprotocol

Products

Typescript-sdk

CVE-2026-113610

Xen Orchestra before 6.9.0 Authorization Bypass via user.set API

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vatesfr Xen-orchestra

Products

Xen-orchestra Xen Orchestra Server