What is the CVSS score of CVE-2026-78278?

CVE-2026-78278 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Fluent Boards Pro CVE-2026-78278

Q: Which versions of Fluent Boards Pro are affected by CVE-2026-78278?

Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers.

EUVD-2026-64785 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-24 Patchstack

GHSA-qrr7-v4w9-q4hr

Authentication Bypass Fluent Boards Pro

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Subscriber title implies low-privilege authentication (PR:L); confidentiality-only impact with no integrity or availability effect warrants C:L, I:N, A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 24, 2026 - 12:37 vuln.today

DescriptionCVE.org

Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.

AnalysisAI

Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers. The vulnerability is classified under CWE-639 and reported by Patchstack with a Medium CVSS score of 5.3. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Delivery

Authenticate to WordPress site

Exploit

Send HTTP request with manipulated object ID

Execution

Bypass missing authorization check

Impact

Read restricted board or task data

Access

Delivery

Authenticate to WordPress site

Exploit

Send HTTP request with manipulated object ID

Execution

Bypass missing authorization check

Impact

Read restricted board or task data

Vulnerability AssessmentAI

Exploitation	The target WordPress installation must have Fluent Boards Pro version 2.0.11 or earlier installed and active. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS base score of 5.3 (Medium) reflects a network-reachable, low-complexity confidentiality impact with no privileges required (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers or already holds a Subscriber-level WordPress account on a site running Fluent Boards Pro 2.0.11 or earlier. They issue HTTP requests to the plugin's board or task retrieval endpoint, substituting object IDs they do not own - iterating through sequential integers or GUIDs - and receive data from boards belonging to other users. …
Remediation	Upgrade Fluent Boards Pro to a version higher than 2.0.11, which is the confirmed vulnerable ceiling. … Detailed patch versions, workarounds, and compensating controls in full report.