CVE-2026-83711

Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Active Directory B2c Entra Id

CVE-2026-109177

MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mogublog Project

Products

Mogublog

CVE-2026-109165

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tduckcloud

Products

Tduck-survey-form

CVE-2026-110238

Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component

Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attackers can dispatch editUser or deleteUser with predictable sequential user ids to reset owner or super admin passwords, promote themselves to owner, and delete users.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Zofe

Products

Rapyd-admin

CVE-2026-110124

FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Kerwincui

Products

Fastbee

CVE-2026-110120

yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Guchengwuyue

Products

Yshopmall

CVE-2026-110119

yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Guchengwuyue

Products

Yshopmall

CVE-2026-110107

RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110098

Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jorani

Products

Jorani

CVE-2026-109195

Quay: repository auto-prune policy uuid idor in quay api

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Quay 3 Quay

CVE-2026-109167

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tduckcloud

Products

Tduck-survey-form

CVE-2026-109963

Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign mailbodyid values in edit requests to read other admins' email templates, including the full administrator's.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Froxlor

Products

Froxlor

CVE-2026-109116

AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization

A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Adithyayelloju

Products

Restaurant-management-system

CVE-2026-108724

Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sylius

Products

Sylius

CVE-2026-78026

Authorization Bypass Through User‑Controlled Key Leading to Privilege Escalation in Dell Secure Connect Gateway Policy Manager

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager

CVE-2026-78023

Authorization Bypass via User‑Controlled Key in Dell Secure Connect Gateway Policy Manager

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager

CVE-2026-76269

Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job metadata, results, and preview results, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully validate job ownership before returning search job information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk Splunk Enterprise

CVE-2026-76278

Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Representational State Transfer (REST) API to access permission grants for SPL2 modules that the user does not have permission to view. The vulnerability is possible because Splunk Enterprise does not verify that the user can read the requested app before the affected REST API returns SPL2 module permission grants. For more information see Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) and Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) in the Splunk documentation. Splunk Enterprise versions 9.4.x are not affected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk Splunk Enterprise

CVE-2026-108608

JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one per request.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg Jeecgboot

Products

Jeecg-boot Jeecg Boot Jeecgboot

CVE-2026-108110

MOVO through 0.2.3 Authorization Bypass via Document Endpoints

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or /api/documents/save-blueprint to read private documents and overwrite presentation blueprints.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Himovo

Products

Movo