CWE-639

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerabili

An insecure direct object reference (IDOR) vulnerability in the Fullstep V5 registration process allows authenticated us

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without an

Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application

This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated at

This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated att

This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An au

A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2

UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of Sm

Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ en

Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared

gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf's Reference S

Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{

Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to befor

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authent

The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on th

Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session P

A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search ind

OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID par

Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do n

When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, ra

OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assi

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains an Insecure Direct Object Re

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.1

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.19.0 and earlier, the protectedProcedure middleware

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing

The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization chec

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0

A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specif

Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit ope

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticate

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the A

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows a

A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify

A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the

MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegatio

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to acc

Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's

Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (i

Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authentica

FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online s

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed valu

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with kno

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom