Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled
CVE-2026-54676
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve
#cwe-862
共收录 4087 条相关情报。
← 返回所有主题Scoold: Authenticated user can post replies and comments to private-space questions without space membership
CVE-2026-54677
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to refer...
CVE-2026-69197
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Acce
Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.
CVE-2026-78528
Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
CVE-2026-74017
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
CVE-2026-74002
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
CVE-2026-74000
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
CVE-2026-66676
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowin...
CVE-2026-87831
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate t
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only...
CVE-2026-91015
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX actio
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action,...
CVE-2026-91010
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any a...
CVE-2026-91009
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation an
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the...
CVE-2026-92589
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video...
CVE-2026-92585
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video...
CVE-2026-92586
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the se
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization (`get_obj...
CVE-2026-61596
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to p...
CVE-2026-92586
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the se
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes ...
CVE-2026-61594
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client...
CVE-2026-61592
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
djust has broken object-level access control (IDOR)
CVE-2026-61596
### Impact djust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) was enforced on the WebSoc