CVE-2026-94229

TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Truebooker

CVE-2026-111680

APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Apiparklab

Products

Apipark

CVE-2026-111645

MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint

MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mrdoc

Products

Mrdoc

CVE-2026-111640

DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs with group_type 'okr'. Authenticated users can supply the dialog_id of OKR comment dialogs to msg__list, msg__one, or msg__send* endpoints to read and inject messages.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dootask

Products

Dootask

CVE-2026-59967

Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Tandoorrecipes

Products

Recipes

CVE-2026-111620

O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

O2oa Zoneland

Products

O2oa O2oa

CVE-2026-111610

B3log Solo through 4.4.0 Missing Authorization in ArticleConsole

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft content via the k parameter, and use push2rhy to push others' articles to the Rhythm community.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

B3log

Products

Solo

CVE-2026-79957

ServiceNext Insecure Direct Object Reference via GetUsarios

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Servicenext

Products

Sertec

CVE-2026-110772

Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update

Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

We-promise

Products

Sure

CVE-2026-105040

EnergizeLab Eilik User-ID Mass Assignment Account Takeover

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Energizelab

Products

Nestjs Auth Service

CVE-2026-111355

zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zhontai

Products

Admin.core

CVE-2026-111364

MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mindoc-org

Products

Mindoc

CVE-2026-15219

IDOR in SFM Software's Costifier

Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sfm Software Technologies

Products

Costifier

CVE-2026-111616

Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oqtane

Products

Oqtane Framework

CVE-2026-111676

Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Faveosuite Ladybirdweb

Products

Faveo-helpdesk Faveo Helpdesk

CVE-2026-111721

Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping

Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jingsewu

Products

Open-wes

CVE-2026-111722

LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Lingguoai

Products

Lingguo-drama

CVE-2026-91050

Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes accepting a params[presets][order_item_id] value that is copied verbatim into the booking object without verifying that the referenced order item belongs to the current customer, is a bundle item, is paid, or has remaining capacity — the is_bundle_scheduling() bundle discriminator is a mere !empty(order_item_id) truthiness check, and the code flow explicitly removes the customer and payment steps when this is truthy (the source even carries a TODO acknowledging the missing validation). This makes it possible for unauthenticated attackers to create approved appointments against other customers' order items and to read those customers' names, email addresses, and order codes returned in the booking confirmation.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Latepoint Wordpress-extensions

Products

Appointment Booking Plugin – Latepoint | Calendar & Scheduling For Wordpress Appointment Booking Plugin

CVE-2026-92715

Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themeum Wordpress-extensions

Products

Tutor Lms – Elearning And Online Course Solution Tutor Lms

CVE-2026-78433

Gitea private attachment disclosure through repository mismatch

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea