Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4977 vulnerabilities reference this CWE, most recent first.
CVE-2026-110853 (GCVE-0-2026-110853)
Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-14 22:52
VLAI
EPSS
VEX
Title
n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON
Summary
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/n8n-before-1… | third-party-advisory |
Impacted products
Date Public
2026-09-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "1.123.83",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.123.83",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "tr4ce-ju"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow\u0027s static data and error-workflow dispatch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T22:52:29.991Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-866p-xg8v-g2q7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-866p-xg8v-g2q7"
},
{
"name": "VulnCheck Advisory: n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n8n-before-1.123.83-authorization-bypass-via-execute-sub-workflow-inline-json"
}
],
"title": "n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110853",
"datePublished": "2026-10-14T22:52:29.991Z",
"dateReserved": "2026-10-14T22:16:22.734Z",
"dateUpdated": "2026-10-14T22:52:29.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110851 (GCVE-0-2026-110851)
Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-14 22:52
VLAI
EPSS
VEX
Title
n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint
Summary
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user with read-only Agent access to another project can supply an existing Agent ID to move that Agent into their own project and rewrite its name, schema and version.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/n8n-before-2… | third-party-advisory |
Impacted products
Date Public
2026-09-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.41.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.42.1",
"status": "affected",
"version": "2.42.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.41.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.42.1",
"versionStartIncluding": "2.42.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "sm1ee"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user with read-only Agent access to another project can supply an existing Agent ID to move that Agent into their own project and rewrite its name, schema and version."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T22:52:27.451Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2r5r-xgvc-rj4p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2r5r-xgvc-rj4p"
},
{
"name": "VulnCheck Advisory: n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-cross-project-agent-ownership-transfer-via-agents-create-endpoint"
}
],
"title": "n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110851",
"datePublished": "2026-10-14T22:52:27.451Z",
"dateReserved": "2026-10-14T22:16:22.734Z",
"dateUpdated": "2026-10-14T22:52:27.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110841 (GCVE-0-2026-110841)
Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-14 22:52
VLAI
EPSS
VEX
Title
n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval
Summary
n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim's conversation.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/n8n-before-2… | third-party-advisory |
Impacted products
Date Public
2026-09-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.41.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.41.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nlgbao1340"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members\u0027 private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim\u0027s conversation."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T22:52:16.473Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p3pg-xw4f-m72c)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-p3pg-xw4f-m72c"
},
{
"name": "VulnCheck Advisory: n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.0-authorization-bypass-in-agent-chat-resume-tool-approval"
}
],
"title": "n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110841",
"datePublished": "2026-10-14T22:52:16.473Z",
"dateReserved": "2026-10-14T22:12:22.054Z",
"dateUpdated": "2026-10-14T22:52:16.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110775 (GCVE-0-2026-110775)
Vulnerability from cvelistv5 – Published: 2026-10-14 18:48 – Updated: 2026-10-14 18:48
VLAI
EPSS
VEX
Title
Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access
Summary
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/nexent-knowledge… | technical-descriptionexploit |
| https://github.com/ModelEngine-Group/nexent/blob/… | technical-description |
| https://github.com/ModelEngine-Group/nexent | product |
| https://www.vulncheck.com/advisories/nexent-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ModelEngine-Group | nexent |
Affected:
0 , ≤ 2.7.0
(semver)
cpe:2.3:a:nexent:nexent:*:*:*:*:*:*:*:* |
Date Public
2026-10-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ModelEngine-Group/nexent",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ModelEngine-Group/nexent",
"product": "nexent",
"repo": "https://github.com/ModelEngine-Group/nexent",
"vendor": "ModelEngine-Group",
"versions": [
{
"lessThanOrEqual": "2.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nexent:nexent:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants\u0027 knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants\u0027 source documents."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:48:05.425Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/nexent-knowledge-base-cross-tenant-file-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ModelEngine-Group/nexent/blob/90bf1a5dbb1eb16bb4a28c2407ed4b6eda9a09bf/backend/services/file_management_service.py#L177"
},
{
"tags": [
"product"
],
"url": "https://github.com/ModelEngine-Group/nexent"
},
{
"name": "VulnCheck Advisory: Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nexent-through-2.7.0-cross-tenant-knowledge-base-file-read-via-check-file-access"
}
],
"title": "Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110775",
"datePublished": "2026-10-14T18:48:05.425Z",
"dateReserved": "2026-10-14T17:27:38.036Z",
"dateUpdated": "2026-10-14T18:48:05.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110774 (GCVE-0-2026-110774)
Vulnerability from cvelistv5 – Published: 2026-10-14 18:48 – Updated: 2026-10-14 18:48
VLAI
EPSS
VEX
Title
Blinko through 1.8.8 Private Attachment Read via /api/file Route
Summary
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/blinko-attachmen… | technical-descriptionexploit |
| https://github.com/blinkospace/blinko/blob/178e4b… | technical-description |
| https://github.com/blinkospace/blinko | product |
| https://www.vulncheck.com/advisories/blinko-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blinkospace | blinko |
Affected:
0 , ≤ 1.8.8
(semver)
cpe:2.3:a:blinko:blinko:*:*:*:*:*:*:*:* |
Date Public
2026-10-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/blinkospace/blinko",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/blinkospace/blinko",
"product": "blinko",
"repo": "https://github.com/blinkospace/blinko",
"vendor": "blinkospace",
"versions": [
{
"lessThanOrEqual": "1.8.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:blinko:blinko:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.8.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users\u0027 private attachments due to a flawed owner check. Attackers can supply another user\u0027s stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:48:03.347Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/blinko-attachment-accountid-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/server/routerExpress/file/file.ts#L148"
},
{
"tags": [
"product"
],
"url": "https://github.com/blinkospace/blinko"
},
{
"name": "VulnCheck Advisory: Blinko through 1.8.8 Private Attachment Read via /api/file Route",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blinko-through-1.8.8-private-attachment-read-via-api-file-route"
}
],
"title": "Blinko through 1.8.8 Private Attachment Read via /api/file Route",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110774",
"datePublished": "2026-10-14T18:48:03.347Z",
"dateReserved": "2026-10-14T17:27:37.426Z",
"dateUpdated": "2026-10-14T18:48:03.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110771 (GCVE-0-2026-110771)
Vulnerability from cvelistv5 – Published: 2026-10-14 18:47 – Updated: 2026-10-14 19:38
VLAI
EPSS
VEX
Title
Shopizer through 3.2.5 Authorization Bypass via Product Review customerId
Summary
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 19:38 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/shopizer-ecommerce/shopizer/is… | issue-tracking |
| https://hackmd.io/@hieuPenguinnn/shopizer-rest-pr… | technical-descriptionexploit |
| https://github.com/shopizer-ecommerce/shopizer/bl… | technical-description |
| https://github.com/shopizer-ecommerce/shopizer | product |
| https://www.vulncheck.com/advisories/shopizer-thr… | third-party-advisory |
Impacted products
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110771",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T19:38:07.606643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T19:38:16.664Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/shopizer-ecommerce/shopizer",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/shopizer-ecommerce/shopizer",
"product": "Shopizer",
"repo": "https://github.com/shopizer-ecommerce/shopizer",
"vendor": "Shopizer",
"versions": [
{
"lessThanOrEqual": "3.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:shopizer:shopizer:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.2.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Leeziao"
},
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:47:57.175Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/shopizer-ecommerce/shopizer/issues/1112"
},
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/shopizer-rest-product-review-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/shopizer-ecommerce/shopizer/blob/9a1602a664ab882b5420ff4339db45af44a48423/sm-shop/src/main/java/com/salesmanager/shop/populator/catalog/PersistableProductReviewPopulator.java#L66"
},
{
"tags": [
"product"
],
"url": "https://github.com/shopizer-ecommerce/shopizer"
},
{
"name": "VulnCheck Advisory: Shopizer through 3.2.5 Authorization Bypass via Product Review customerId",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/shopizer-through-3.2.5-authorization-bypass-via-product-review-customerid"
}
],
"title": "Shopizer through 3.2.5 Authorization Bypass via Product Review customerId",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110771",
"datePublished": "2026-10-14T18:47:57.175Z",
"dateReserved": "2026-10-14T17:27:35.843Z",
"dateUpdated": "2026-10-14T19:38:16.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110764 (GCVE-0-2026-110764)
Vulnerability from cvelistv5 – Published: 2026-10-14 18:47 – Updated: 2026-10-14 18:47
VLAI
EPSS
VEX
Title
AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download
Summary
AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/iflytek-astron-r… | technical-descriptionexploit |
| https://github.com/iflytek/astron-rpa/blob/b66e7c… | technical-description |
| https://github.com/iflytek/astron-rpa | product |
| https://www.vulncheck.com/advisories/astronrpa-th… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iflytek | astron-rpa |
Affected:
0 , ≤ 1.1.6
(semver)
|
Date Public
2026-10-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/iflytek/astron-rpa",
"defaultStatus": "unaffected",
"product": "astron-rpa",
"repo": "https://github.com/iflytek/astron-rpa",
"vendor": "iflytek",
"versions": [
{
"lessThanOrEqual": "1.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants\u0027 files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:47:40.054Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/iflytek-astron-rpa-file-download-cross-tenant-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/iflytek/astron-rpa/blob/b66e7c9e445906583c161bc9925432d6d39ca001/backend/resource-service/src/main/java/com/iflytek/rpa/resource/file/dao/FileMapper.java#L18"
},
{
"tags": [
"product"
],
"url": "https://github.com/iflytek/astron-rpa"
},
{
"name": "VulnCheck Advisory: AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-cross-tenant-file-disclosure-via-file-download"
}
],
"title": "AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110764",
"datePublished": "2026-10-14T18:47:40.054Z",
"dateReserved": "2026-10-14T17:27:32.052Z",
"dateUpdated": "2026-10-14T18:47:40.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110763 (GCVE-0-2026-110763)
Vulnerability from cvelistv5 – Published: 2026-10-14 18:47 – Updated: 2026-10-14 18:47
VLAI
EPSS
VEX
Title
lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany
Summary
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.
Severity
4.3 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/lamp-boot-findde… | technical-descriptionexploit |
| https://github.com/zuihou/lamp-boot/blob/ddef8c71… | technical-description |
| https://github.com/zuihou/lamp-boot | product |
| https://www.vulncheck.com/advisories/lamp-boot-4.… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/zuihou/lamp-boot",
"defaultStatus": "unaffected",
"product": "lamp-boot",
"repo": "https://github.com/zuihou/lamp-boot",
"vendor": "zuihou",
"versions": [
{
"lessThanOrEqual": "4.21.2-java17",
"status": "affected",
"version": "4.16.0-java17",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module\u0027s /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee\u0027s department membership within the tenant."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:47:39.046Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/lamp-boot-finddeptbycompany-employee-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zuihou/lamp-boot/blob/ddef8c71de970b915ba1b15e0e9c2dd7414074de/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L167"
},
{
"tags": [
"product"
],
"url": "https://github.com/zuihou/lamp-boot"
},
{
"name": "VulnCheck Advisory: lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lamp-boot-4.16.0-java17-through-4.21.2-java17-idor-via-anyone-finddeptbycompany"
}
],
"title": "lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110763",
"datePublished": "2026-10-14T18:47:39.046Z",
"dateReserved": "2026-10-14T17:27:31.488Z",
"dateUpdated": "2026-10-14T18:47:39.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110724 (GCVE-0-2026-110724)
Vulnerability from cvelistv5 – Published: 2026-10-15 12:11 – Updated: 2026-10-15 12:11
VLAI
EPSS
VEX
Summary
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
Severity
No CVSS data available.
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse Connected Services Platform |
Affected:
1.1.1 , ≤ 1.7.3
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eclipse Connected Services Platform",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "1.7.3",
"status": "affected",
"version": "1.1.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets \u2014 one per unique header value \u2014 and completely bypass the gateway\u0027s request-rate limiting on every route that uses the shipped default configuration.\u003c/p\u003e"
}
],
"value": "In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets \u2014 one per unique header value \u2014 and completely bypass the gateway\u0027s request-rate limiting on every route that uses the shipped default configuration."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T12:11:37.639Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-ecsp/api-gateway/pull/330"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/405"
},
{
"url": "https://github.com/eclipse-ecsp/api-gateway/security/advisories/GHSA-4j9j-mx7g-p9p6"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-110724",
"datePublished": "2026-10-15T12:11:22.470Z",
"dateReserved": "2026-10-14T14:53:22.659Z",
"dateUpdated": "2026-10-15T12:11:37.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110620 (GCVE-0-2026-110620)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 14:16
VLAI
EPSS
VEX
Title
Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId
Summary
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.
Severity
6.8 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/formbricks/formbricks/issues/7326 | issue-tracking |
| https://github.com/formbricks/formbricks/blob/4.8… | technical-description |
| https://github.com/formbricks/formbricks/blob/4.8… | technical-description |
| https://github.com/formbricks/formbricks/commit/c… | patch |
| https://github.com/formbricks/formbricks/releases… | release-notes |
| https://www.vulncheck.com/advisories/formbricks-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| formbricks | formbricks |
Affected:
0 , < 4.9.0
(semver)
|
Date Public
2026-02-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/formbricks/formbricks",
"defaultStatus": "unaffected",
"product": "formbricks",
"repo": "https://github.com/formbricks/formbricks",
"vendor": "formbricks",
"versions": [
{
"lessThan": "4.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:57.917Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/formbricks/formbricks/issues/7326"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/app/(app)/environments/%5BenvironmentId%5D/surveys/%5BsurveyId%5D/(analysis)/summary/actions.ts#L65-L95"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/formbricks/formbricks/blob/4.8.7/apps/web/modules/organization/settings/teams/actions.ts#L33-L50"
},
{
"tags": [
"patch"
],
"url": "https://github.com/formbricks/formbricks/commit/c7faa29437ea706eae411958b260bb5ad5c60e4f"
},
{
"name": "Formbricks 4.9.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/formbricks/formbricks/releases/tag/4.9.0"
},
{
"name": "VulnCheck Advisory: Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/formbricks-before-4.9.0-cross-organization-idor-in-server-actions-via-organizationid"
}
],
"title": "Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110620",
"datePublished": "2026-10-14T14:16:57.917Z",
"dateReserved": "2026-10-14T13:07:26.834Z",
"dateUpdated": "2026-10-14T14:16:57.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.