Fluentboards
Monthly
Authorization bypass in FluentBoards up to 1.91.2 allows authenticated users to access and modify board data belonging to other users. The vulnerability, categorized as CWE-639, stems from improper access controls on user-controlled keys. At the time of analysis, no active exploitation has been reported, and EPSS indicates a very low exploitation probability (0.02%).
Insecure Direct Object Reference in FluentBoards WordPress plugin before 1.95.3 allows any authenticated user holding member access to at least one board to silently exfiltrate task titles, descriptions, and file attachments from all other boards on the site by supplying arbitrary board item identifiers in an import request. The server performs no authorization check to verify that requested items belong to boards the invoking user is permitted to access, making any board member a potential insider threat against sensitive project data. A public proof-of-concept is available via WPScan; however, EPSS sits at 0.13% (3rd percentile) and no CISA KEV entry exists, indicating limited observed exploitation despite disclosure.
Authorization bypass in FluentBoards up to 1.91.2 allows authenticated users to access and modify board data belonging to other users. The vulnerability, categorized as CWE-639, stems from improper access controls on user-controlled keys. At the time of analysis, no active exploitation has been reported, and EPSS indicates a very low exploitation probability (0.02%).
Insecure Direct Object Reference in FluentBoards WordPress plugin before 1.95.3 allows any authenticated user holding member access to at least one board to silently exfiltrate task titles, descriptions, and file attachments from all other boards on the site by supplying arbitrary board item identifiers in an import request. The server performs no authorization check to verify that requested items belong to boards the invoking user is permitted to access, making any board member a potential insider threat against sensitive project data. A public proof-of-concept is available via WPScan; however, EPSS sits at 0.13% (3rd percentile) and no CISA KEV entry exists, indicating limited observed exploitation despite disclosure.