Monthly
Insecure Direct Object Reference (IDOR) in JetBrains YouTrack before 2026.2.18634 allows authenticated low-privileged users to enumerate and read private issues and starred folder contents belonging to other users across organizational boundaries by manipulating user profile API identifiers. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/C:H) reflects straightforward network exploitation requiring only a valid session. No public exploit or KEV listing is present, but the low attack complexity and high confidentiality impact make this a meaningful data-exposure risk in multi-tenant or multi-organization YouTrack deployments.
Insecure Direct Object Reference in JetBrains YouTrack before version 2026.2.18634 permits authenticated users to access other users' private saved searches through the watchRules and issueListConfig API endpoints. The endpoints fail to enforce authorization checks on user-controlled object identifiers, allowing horizontal privilege escalation without elevated permissions. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Signed URL reuse in JetBrains YouTrack before 2026.2.18634 permits authenticated users to access restricted project icons they are not authorized to view. The flaw arises because signed URLs generated for project icon assets are not properly scoped or invalidated, allowing the same URL to be reused beyond its intended access context. No public exploit code has been identified and the vendor has issued a patch, making this a low-urgency but straightforward authorization control deficiency in a widely used issue tracker.
Authenticated users in MISP ≤2.5.45 can retrieve object-reference records outside their authorized scope via an Insecure Direct Object Reference (IDOR) flaw in EventGraphTool::get_reference_data(). The vulnerable code queried ObjectReference by UUID and returned the matching row without verifying the requesting user has access to the parent object the reference belongs to. An authenticated attacker who knows or enumerates a reference UUID can access reference metadata - including relationship types, comments, and referenced UUIDs - from objects in events they are not permitted to view. No public exploit or CISA KEV entry exists at time of analysis.
Insecure Direct Object Reference in Otter Blocks (WordPress plugin by Themeisle) through version 3.1.7 enables unauthenticated attackers to decouple the `product_id` and `price_id` parameters in a Stripe checkout URL, paying the price of a cheaper product while the `watch_checkout` function grants entitlement for the premium product whose ID was substituted. The flaw is exploitable against any WordPress site running the plugin with a Stripe checkout block configured. No public exploit has been identified at time of analysis, and a patch commit (changeset 3496611) has been applied to the plugin repository.
Unauthenticated IDOR (Insecure Direct Object Reference) in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to delete arbitrary exam records by manipulating the `ID` parameter in `delete_exam.php` without any authorization check. Any network-accessible attacker can iterate over exam IDs to destroy examination data belonging to other users or system administrators. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for opportunistic abuse.
Authorization bypass in sfturing hosp_order exposes its order cancellation endpoint to manipulation of the ID parameter, allowing an attacker to cancel medical orders belonging to any patient without owning those records (CWE-639 IDOR). The vulnerable function is orderRecordsService.cancelOrder in OrderController.java within this Java/SSM-stack hospital management application. A public exploit is documented in GitHub issue #116; the project maintainer has not responded to the disclosure, leaving no remediated version available.
Authorization bypass in sfturing hosp_order allows unauthenticated remote attackers to modify hospital order records belonging to arbitrary users by supplying attacker-controlled `userID` or `id` parameters to the `updateOrderSta1` and `updateOrderdiseaseInfo` endpoints in OrderController.java. A public proof-of-concept exploit was disclosed via GitHub issue #115; the maintainer has not responded to the report. The project follows a rolling release strategy, making version-pinned remediation guidance impossible - all commits through 627f426331da8086ce8fff2017d65b1ddef384f8 are confirmed affected.
Authorization bypass through user-controlled key (IDOR, CWE-639) in sfturing hosp_order's OrderController allows unauthenticated remote attackers to access or manipulate hospital order records belonging to arbitrary users by supplying a crafted `userIdenf` parameter. The affected codebase is a Java Spring-based hospital order management system, and the vulnerability is exposed via the `/ssm_pro` web application endpoint. A public proof-of-concept exists via GitHub issue #114; the maintainer has not responded to the disclosure, and no patch has been released.
Insecure direct object reference (IDOR) in the dmWidget component of diem-project/diem (versions through 5.1.3) allows unauthenticated remote attackers to bypass authorization controls by manipulating the `widget_id` parameter in `BasedmWidgetActions.class.php`, exposing widget data belonging to other users or contexts. A public proof-of-concept exists via GitHub issue #450, and the upstream project has not responded to the coordinated disclosure despite early notification. The CVSS 4.0 score of 5.5 reflects the limited blast radius - confidentiality impact only, with no integrity or availability consequences confirmed.
Insecure Direct Object Reference (IDOR) in JetBrains YouTrack before 2026.2.18634 allows authenticated low-privileged users to enumerate and read private issues and starred folder contents belonging to other users across organizational boundaries by manipulating user profile API identifiers. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/C:H) reflects straightforward network exploitation requiring only a valid session. No public exploit or KEV listing is present, but the low attack complexity and high confidentiality impact make this a meaningful data-exposure risk in multi-tenant or multi-organization YouTrack deployments.
Insecure Direct Object Reference in JetBrains YouTrack before version 2026.2.18634 permits authenticated users to access other users' private saved searches through the watchRules and issueListConfig API endpoints. The endpoints fail to enforce authorization checks on user-controlled object identifiers, allowing horizontal privilege escalation without elevated permissions. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Signed URL reuse in JetBrains YouTrack before 2026.2.18634 permits authenticated users to access restricted project icons they are not authorized to view. The flaw arises because signed URLs generated for project icon assets are not properly scoped or invalidated, allowing the same URL to be reused beyond its intended access context. No public exploit code has been identified and the vendor has issued a patch, making this a low-urgency but straightforward authorization control deficiency in a widely used issue tracker.
Authenticated users in MISP ≤2.5.45 can retrieve object-reference records outside their authorized scope via an Insecure Direct Object Reference (IDOR) flaw in EventGraphTool::get_reference_data(). The vulnerable code queried ObjectReference by UUID and returned the matching row without verifying the requesting user has access to the parent object the reference belongs to. An authenticated attacker who knows or enumerates a reference UUID can access reference metadata - including relationship types, comments, and referenced UUIDs - from objects in events they are not permitted to view. No public exploit or CISA KEV entry exists at time of analysis.
Insecure Direct Object Reference in Otter Blocks (WordPress plugin by Themeisle) through version 3.1.7 enables unauthenticated attackers to decouple the `product_id` and `price_id` parameters in a Stripe checkout URL, paying the price of a cheaper product while the `watch_checkout` function grants entitlement for the premium product whose ID was substituted. The flaw is exploitable against any WordPress site running the plugin with a Stripe checkout block configured. No public exploit has been identified at time of analysis, and a patch commit (changeset 3496611) has been applied to the plugin repository.
Unauthenticated IDOR (Insecure Direct Object Reference) in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to delete arbitrary exam records by manipulating the `ID` parameter in `delete_exam.php` without any authorization check. Any network-accessible attacker can iterate over exam IDs to destroy examination data belonging to other users or system administrators. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for opportunistic abuse.
Authorization bypass in sfturing hosp_order exposes its order cancellation endpoint to manipulation of the ID parameter, allowing an attacker to cancel medical orders belonging to any patient without owning those records (CWE-639 IDOR). The vulnerable function is orderRecordsService.cancelOrder in OrderController.java within this Java/SSM-stack hospital management application. A public exploit is documented in GitHub issue #116; the project maintainer has not responded to the disclosure, leaving no remediated version available.
Authorization bypass in sfturing hosp_order allows unauthenticated remote attackers to modify hospital order records belonging to arbitrary users by supplying attacker-controlled `userID` or `id` parameters to the `updateOrderSta1` and `updateOrderdiseaseInfo` endpoints in OrderController.java. A public proof-of-concept exploit was disclosed via GitHub issue #115; the maintainer has not responded to the report. The project follows a rolling release strategy, making version-pinned remediation guidance impossible - all commits through 627f426331da8086ce8fff2017d65b1ddef384f8 are confirmed affected.
Authorization bypass through user-controlled key (IDOR, CWE-639) in sfturing hosp_order's OrderController allows unauthenticated remote attackers to access or manipulate hospital order records belonging to arbitrary users by supplying a crafted `userIdenf` parameter. The affected codebase is a Java Spring-based hospital order management system, and the vulnerability is exposed via the `/ssm_pro` web application endpoint. A public proof-of-concept exists via GitHub issue #114; the maintainer has not responded to the disclosure, and no patch has been released.
Insecure direct object reference (IDOR) in the dmWidget component of diem-project/diem (versions through 5.1.3) allows unauthenticated remote attackers to bypass authorization controls by manipulating the `widget_id` parameter in `BasedmWidgetActions.class.php`, exposing widget data belonging to other users or contexts. A public proof-of-concept exists via GitHub issue #450, and the upstream project has not responded to the coordinated disclosure despite early notification. The CVSS 4.0 score of 5.5 reflects the limited blast radius - confidentiality impact only, with no integrity or availability consequences confirmed.