CWE-639

1,777 vulnerabilities with CWE-639

CVE-2026-9493 MEDIUM

BankPro E-Service Technology｜Service Center - Insecure Direct Object Reference

CVSS 6.5

CVE-2026-47713 LOW

AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration

CVSS 2.0

CVE-2026-45342 HIGH

LinkAce < 2.5.6 - Authenticated Insecure Direct Object Reference

CVE-2026-45297 MEDIUM

Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch

CVE-2026-41160 MEDIUM

EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes

CVSS 4.3

CVE-2026-41141 MEDIUM

EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup

CVSS 6.5

CVE-2026-7651 MEDIUM

User Registration & Membership < 5.1.5 - IDOR

CVSS 5.3

CVE-2026-3173 MEDIUM

Meta Field Block <= 1.5.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure

CVSS 6.5

CVE-2026-9241 MEDIUM

Fox – Currency Switcher Professional For WooCommerce < 1.4.6 - Authorization Bypass

CVSS 4.3

CVE-2026-9228 MEDIUM

Timetable And Event Schedule BY MotoPress < 2.4.16 - IDOR

CVSS 4.3

CVE-2026-46544 MEDIUM

Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requesters

CVSS 5.3

CVE-2026-46414 HIGH

Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking

CVSS 8.8

CVE-2026-4868 HIGH

Authorization Bypass Through User-Controlled Key in GitLab

CVSS 8.2

CVE-2026-38807 HIGH

kvf-admin 1.0.0 - Insecure Permissions Privilege Escalation via UserController.java

CVSS 8.8

CVE-2026-9712 LOW

pretix - Insecure Direct Object Reference

CVE-2026-42736 HIGH

WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability

CVSS 7.5

CVE-2026-42725 MEDIUM

WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability

CVSS 6.5

CVE-2026-8890 HIGH

code100x Mobile API Authentication Bypass via Header Spoofing

CVSS 8.2

CVE-2026-44776 MEDIUM

Kavita: IDOR in /api/Download/*

CVE-2026-47716 LOW

Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known

CVSS 3.1

CVE-2026-47715 LOW

Bugsink: Issue event views can show an event from another project if its UUID is known

CVSS 3.1

CVE-2026-43934 MEDIUM

e107: Broken Access Control in e107 comment edit allows cross-user comment modification

CVSS 6.5

CVE-2026-38587 MEDIUM

ONLYOFFICE DocSpace < 3.2.1 - Authenticated Insecure Direct Object Reference in REST API

CVSS 4.3

CVE-2026-40127 MEDIUM

Authorization Bypass Through User-Controlled Key in OutSystems Lifetime

CVE-2026-9306 LOW

QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization

CVSS 3.7