CWE-639

1,570 vulnerabilities with CWE-639

CVE-2026-28788 HIGH

Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

CVSS 7.1

CVE-2026-28503 MEDIUM

Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404

CVSS 6.5

CVE-2026-1206 MEDIUM

Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

CVSS 4.3

CVE-2026-34055 HIGH

OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification

CVSS 8.1

CVE-2026-33934 MEDIUM

OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures

CVSS 4.3

CVE-2026-33931 MEDIUM

OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access

CVSS 6.5

CVE-2026-32120 MEDIUM

OpenEMR has IDOR in Fee Sheet Product Save

CVSS 6.5

CVE-2026-33724 HIGH

n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no

CVSS 7.4

CVE-2026-33663 MEDIUM

n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition

CVSS 6.5

CVE-2026-32535 MEDIUM

WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability

CVSS 6.5

CVE-2026-32533 MEDIUM

WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability

CVSS 6.5

CVE-2026-2414 CRITICAL

Hypr Server < 10.7.2 - Privilege Escalation

CVSS 9.8

CVE-2026-33511 CRITICAL

pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad

CVSS 9.8

CVE-2026-33345 MEDIUM

solidtime vulnerable to IDOR in private projects

CVSS 6.5

CVE-2026-33160 MEDIUM

Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL

CVSS 5.3

CVE-2026-33158 MEDIUM

Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

CVSS 6.5

CVE-2026-33700 MEDIUM

Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

CVSS 4.9

CVE-2026-33678 HIGH

Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

CVSS 8.1

CVE-2026-33313 MEDIUM

Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments

CVSS 4.3

CVE-2026-33484 HIGH

Langflow has Unauthenticated IDOR on Image Downloads

CVSS 7.5

CVE-2026-32300 HIGH

Connect-CMS 1.x-1.41.0/2.x-2.41.0 - Privilege Escalation

CVSS 8.1

CVE-2026-23488 MEDIUM

Blinko: multiple interfaces in the comment feature allow unauthorized access

CVSS 5.3

CVE-2026-23487 MEDIUM

Blinko <1.8.4 - IDOR

CVSS 6.5

CVE-2026-30886 MEDIUM

New API <0.11.4-alpha.2 - IDOR

CVSS 6.5

CVE-2026-33297 CRITICAL

AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

CVSS 9.1