CWE-639

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the admin

Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Explo

An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable due to Insecure Direct Object Reference (IDOR)

A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of

A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capab

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and i

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectl

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectl

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Inco

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectl

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrec

Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting I

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorr

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorr

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Objec

Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direc

Authorization Bypass Through User-Controlled Key vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikY

The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i

A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. After obtaining a course ID, a

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to versi

Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event par

Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability ex

The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNot

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including

OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0,

Authorization Bypass Through User-Controlled Key vulnerability in wpstream WpStream wpstream allows Exploiting Incorrect

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3

EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Em

Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.7

A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edi

A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_us

A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This issue affects the function update_organ

A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/C

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restri

A security vulnerability has been detected in LinkStackOrg LinkStack up to 4.8.6. The affected element is the function s

A vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote attacker to access the social

An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other use

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerabil

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware seri

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.

Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id par

Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / au