CVE-2026-113599

Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Modoboa

Products

Modoboa

CVE-2026-113597

Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Blinko Blinkospace

Products

Blinko Blinko

CVE-2026-113353

LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress-extensions

Products

Learnpress Learnpress

CVE-2026-112004

Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Teableio

Products

Teable

CVE-2026-77935

Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Coze

Products

Coze Studio

CVE-2026-111902

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq Thorsten

Products

Phpmyfaq Phpmyfaq

CVE-2026-84167

Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Hotel Booking

CVE-2026-111908

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq Thorsten

Products

Phpmyfaq Phpmyfaq

CVE-2026-110494

Gitea release attachment re-linking of issue attachments

Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size and download count of the attachment through the release and allowed the user to rename or delete it.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea

CVE-2026-110851

n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user with read-only Agent access to another project can supply an existing Agent ID to move that Agent into their own project and rewrite its name, schema and version.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-110841

n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval

n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim's conversation.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-110763

lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zuihou

Products

Lamp-boot

CVE-2026-110611

REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Getrebuild

Products

Rebuild

CVE-2026-104898

Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the attacking user to be linked to at least one Bookly staff record, which occurs by default whenever an admin enables the bookly_gen_allow_staff_edit_profile option (active on fresh installs) and links a WordPress user to a staff entry.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ladela Wordpress-extensions

Products

Online Scheduling And Appointment Booking System – Bookly Bookly

CVE-2026-112286

Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Krayin

Products

Laravel-crm

CVE-2026-112287

Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Krayin

Products

Laravel-crm

CVE-2026-66076

RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Broadcom Rabbitmq

Products

Rabbitmq Server Rabbitmq-server

CVE-2026-111939

Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Helpdesk

CVE-2026-112043

calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Calcom

Products

Cal.com Cal.diy

CVE-2026-111912

Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Admidio

Products

Admidio