Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5165 vulnerabilities reference this CWE, most recent first.
CVE-2026-111366 (GCVE-0-2026-111366)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 15:53
VLAI
EPSS
VEX
Title
cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints
Summary
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:53 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/cool-admin-midwa… | third-party-advisory |
| https://github.com/cool-team-official/cool-admin-… | technical-description |
| https://github.com/cool-team-official/cool-admin-… | technical-description |
| https://github.com/cool-team-official/cool-admin-midway | product |
| https://www.vulncheck.com/advisories/cool-admin-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cool-team-official | cool-admin-midway |
Affected:
0 , ≤ 8.0.0
(semver)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111366",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:53:05.778720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:53:26.458Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/cool-admin-midway-base-crud-role-ownership-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/cool-team-official/cool-admin-midway",
"product": "cool-admin-midway",
"repo": "https://github.com/cool-team-official/cool-admin-midway",
"vendor": "cool-team-official",
"versions": [
{
"lessThanOrEqual": "8.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:49.835Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/cool-admin-midway-base-crud-role-ownership-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cool-team-official/cool-admin-midway/blob/e545ef6f3b0c08581e34bd3207ca57d851ccc3ae/src/modules/base/service/sys/user.ts#L41-L70"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cool-team-official/cool-admin-midway/blob/e545ef6f3b0c08581e34bd3207ca57d851ccc3ae/src/modules/base/service/sys/user.ts#L205-L229"
},
{
"tags": [
"product"
],
"url": "https://github.com/cool-team-official/cool-admin-midway"
},
{
"name": "VulnCheck Advisory: cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cool-admin-midway-through-8.0.0-authorization-bypass-via-admin-sys-user-endpoints"
}
],
"title": "cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111366",
"datePublished": "2026-10-15T21:43:49.835Z",
"dateReserved": "2026-10-15T21:21:17.571Z",
"dateUpdated": "2026-10-16T15:53:26.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111365 (GCVE-0-2026-111365)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 16:32
VLAI
EPSS
VEX
Title
cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints
Summary
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:31 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/cool-admin-midwa… | third-party-advisory |
| https://github.com/cool-team-official/cool-admin-… | technical-description |
| https://github.com/cool-team-official/cool-admin-… | technical-description |
| https://github.com/cool-team-official/cool-admin-midway | product |
| https://www.vulncheck.com/advisories/cool-admin-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cool-team-official | cool-admin-midway |
Affected:
0 , ≤ 8.0.0
(semver)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111365",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:31:50.609082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:32:15.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/cool-admin-midway-base-crud-role-ownership-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/cool-team-official/cool-admin-midway",
"product": "cool-admin-midway",
"repo": "https://github.com/cool-team-official/cool-admin-midway",
"vendor": "cool-team-official",
"versions": [
{
"lessThanOrEqual": "8.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins\u0027 roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin\u0027s role id to rewrite menu and department grants, changing other users\u0027 effective access."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:49.146Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/cool-admin-midway-base-crud-role-ownership-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cool-team-official/cool-admin-midway/blob/e545ef6f3b0c08581e34bd3207ca57d851ccc3ae/src/modules/base/controller/admin/sys/role.ts#L11-L36"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cool-team-official/cool-admin-midway/blob/e545ef6f3b0c08581e34bd3207ca57d851ccc3ae/src/modules/base/service/sys/role.ts#L54-L118"
},
{
"tags": [
"product"
],
"url": "https://github.com/cool-team-official/cool-admin-midway"
},
{
"name": "VulnCheck Advisory: cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cool-admin-midway-through-8.0.0-missing-authorization-via-system-role-endpoints"
}
],
"title": "cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111365",
"datePublished": "2026-10-15T21:43:49.146Z",
"dateReserved": "2026-10-15T21:21:12.363Z",
"dateUpdated": "2026-10-16T16:32:15.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111364 (GCVE-0-2026-111364)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 17:08
VLAI
EPSS
VEX
Title
MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch
Summary
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:31 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/mindoc-api-conte… | third-party-advisory |
| https://github.com/mindoc-org/mindoc/blob/v2.2-be… | technical-description |
| https://github.com/mindoc-org/mindoc/blob/v2.2-be… | technical-description |
| https://github.com/mindoc-org/mindoc | product |
| https://www.vulncheck.com/advisories/mindoc-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mindoc-org | MinDoc |
Affected:
0 , ≤ 2.2-beta.2
(custom)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111364",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:31:45.830855Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:08:10.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/mindoc-org/mindoc",
"product": "MinDoc",
"repo": "https://github.com/mindoc-org/mindoc",
"vendor": "mindoc-org",
"versions": [
{
"lessThanOrEqual": "2.2-beta.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:48.449Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/mindoc-api-content-get-cross-book-document-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mindoc-org/mindoc/blob/v2.2-beta.2/controllers/DocumentController.go#L847-L973"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mindoc-org/mindoc/blob/v2.2-beta.2/routers/router.go#L242"
},
{
"tags": [
"product"
],
"url": "https://github.com/mindoc-org/mindoc"
},
{
"name": "VulnCheck Advisory: MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mindoc-through-2.2-beta.2-idor-via-api-key-content-id-get-branch"
}
],
"title": "MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111364",
"datePublished": "2026-10-15T21:43:48.449Z",
"dateReserved": "2026-10-15T21:21:05.161Z",
"dateUpdated": "2026-10-16T17:08:10.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111363 (GCVE-0-2026-111363)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 14:19
VLAI
EPSS
VEX
Title
BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox
Summary
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:17 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/bisheng-knowledg… | third-party-advisory |
| https://github.com/dataelement/bisheng/blob/v3.0.… | technical-description |
| https://github.com/dataelement/bisheng/blob/v3.0.… | technical-description |
| https://github.com/dataelement/bisheng | product |
| https://www.vulncheck.com/advisories/bisheng-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dataelement | bisheng |
Affected:
0 , ≤ 3.0.0-beta4
(custom)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111363",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:17:33.225838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:19:20.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/bisheng-knowledge-file-bbox-cross-user-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/dataelement/bisheng",
"product": "bisheng",
"repo": "https://github.com/dataelement/bisheng",
"vendor": "dataelement",
"versions": [
{
"lessThanOrEqual": "3.0.0-beta4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users\u0027 parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users\u0027 and tenants\u0027 knowledge bases."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:47.748Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/bisheng-knowledge-file-bbox-cross-user-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dataelement/bisheng/blob/v3.0.0-beta4/src/backend/bisheng/knowledge/api/endpoints/knowledge.py#L663-L670"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dataelement/bisheng/blob/v3.0.0-beta4/src/backend/bisheng/knowledge/domain/services/knowledge_service.py#L2523-L2533"
},
{
"tags": [
"product"
],
"url": "https://github.com/dataelement/bisheng"
},
{
"name": "VulnCheck Advisory: BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bisheng-through-3.0.0-beta4-idor-via-api-v1-knowledge-file-bbox"
}
],
"title": "BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111363",
"datePublished": "2026-10-15T21:43:47.748Z",
"dateReserved": "2026-10-15T21:21:00.160Z",
"dateUpdated": "2026-10-16T14:19:20.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111359 (GCVE-0-2026-111359)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-15 21:43
VLAI
EPSS
VEX
Title
CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
Summary
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/crmeb-gift-order… | third-party-advisory |
| https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/… | technical-description |
| https://github.com/crmeb/CRMEB | product |
| https://www.vulncheck.com/advisories/crmeb-5.6.1-… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/crmeb/CRMEB",
"product": "CRMEB",
"repo": "https://github.com/crmeb/CRMEB",
"vendor": "crmeb",
"versions": [
{
"lessThanOrEqual": "6.0.0",
"status": "affected",
"version": "5.6.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:crmeb:crmeb:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.0.0",
"versionStartIncluding": "5.6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users\u0027 orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:47.038Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/crmeb-gift-order-idor-takeover"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/app/services/order/StoreOrderServices.php#L2998-L3085"
},
{
"tags": [
"product"
],
"url": "https://github.com/crmeb/CRMEB"
},
{
"name": "VulnCheck Advisory: CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crmeb-5.6.1-through-6.0.0-idor-via-giftdetail-and-receivegift"
}
],
"title": "CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111359",
"datePublished": "2026-10-15T21:43:47.038Z",
"dateReserved": "2026-10-15T20:57:06.851Z",
"dateUpdated": "2026-10-15T21:43:47.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111358 (GCVE-0-2026-111358)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 15:55
VLAI
EPSS
VEX
Title
SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form
Summary
SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:55 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/sendportal-subsc… | third-party-advisory |
| https://github.com/mettle/sendportal-core/blob/v4… | technical-description |
| https://github.com/mettle/sendportal-core/blob/v4… | technical-description |
| https://github.com/mettle/sendportal-core | product |
| https://www.vulncheck.com/advisories/sendportal-s… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mettle | sendportal-core |
Affected:
0 , ≤ 4.0.1
(semver)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111358",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:55:17.600296Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:55:23.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/mettle/sendportal-core",
"product": "sendportal-core",
"repo": "https://github.com/mettle/sendportal-core",
"vendor": "mettle",
"versions": [
{
"lessThanOrEqual": "4.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces\u0027 tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:46.335Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/sendportal-subscriber-tags-cross-workspace-attach"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Repositories/Subscribers/BaseSubscriberTenantRepository.php#L48-L51"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mettle/sendportal-core/blob/v4.0.1/src/Http/Requests/SubscriberRequest.php#L34-L37"
},
{
"tags": [
"product"
],
"url": "https://github.com/mettle/sendportal-core"
},
{
"name": "VulnCheck Advisory: SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sendportal-sendportal-core-through-4.0.1-cross-workspace-tag-attachment-via-subscriber-form"
}
],
"title": "SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111358",
"datePublished": "2026-10-15T21:43:46.335Z",
"dateReserved": "2026-10-15T20:57:01.492Z",
"dateUpdated": "2026-10-16T15:55:23.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111355 (GCVE-0-2026-111355)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 17:08
VLAI
EPSS
VEX
Title
zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints
Summary
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:31 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/zhontai-admin-co… | third-party-advisory |
| https://github.com/zhontai/Admin.Core/blob/v10.1.… | technical-description |
| https://github.com/zhontai/Admin.Core/blob/v10.1.… | technical-description |
| https://github.com/zhontai/Admin.Core/blob/v10.1.… | technical-description |
| https://github.com/zhontai/Admin.Core/blob/v10.1.… | technical-description |
| https://github.com/zhontai/Admin.Core/blob/v10.1.… | technical-description |
| https://www.vulncheck.com/advisories/zhontai-admi… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zhontai | Admin.Core |
Affected:
0 , ≤ 10.1.0
(semver)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111355",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:31:44.154339Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:08:19.434Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/zhontai/Admin.Core",
"product": "Admin.Core",
"repo": "https://github.com/zhontai/Admin.Core",
"vendor": "zhontai",
"versions": [
{
"lessThanOrEqual": "10.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:44.503Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/zhontai-admin-core-by-id-missing-data-scope-cross-dept"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L118-L144"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L595-L636"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L887-L900"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L977-L1000"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/Org/OrgService.cs#L64-L68"
},
{
"name": "VulnCheck Advisory: zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zhontai-admin-core-through-10.1.0-authorization-bypass-via-user-and-organization-by-id-endpoints"
}
],
"title": "zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111355",
"datePublished": "2026-10-15T21:43:44.503Z",
"dateReserved": "2026-10-15T20:56:00.638Z",
"dateUpdated": "2026-10-16T17:08:19.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111354 (GCVE-0-2026-111354)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 14:21
VLAI
EPSS
VEX
Title
crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints
Summary
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:20 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/crmeb-java-order… | third-party-advisory |
| https://github.com/crmeb/crmeb_java/blob/31bb30dd… | technical-description |
| https://github.com/crmeb/crmeb_java/blob/31bb30dd… | technical-description |
| https://github.com/crmeb/crmeb_java/blob/31bb30dd… | technical-description |
| https://www.vulncheck.com/advisories/crmeb-java-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| crmeb | crmeb_java |
Affected:
0 , ≤ 3.1
(custom)
cpe:2.3:a:crmeb:crmeb_java:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111354",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:20:36.398748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:21:47.772Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/crmeb-java-order-express-refund-cross-member-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/crmeb/crmeb_java",
"product": "crmeb_java",
"repo": "https://github.com/crmeb/crmeb_java",
"vendor": "crmeb",
"versions": [
{
"lessThanOrEqual": "3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:crmeb:crmeb_java:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members\u0027 orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims\u0027 tracking numbers, logistics traces, payment amounts and product lines."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:43.756Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/crmeb-java-order-express-refund-cross-member-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L766-L771"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L832-L836"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/crmeb/crmeb_java/blob/31bb30dd240dc1168c7eeef065edf36b9700022e/backend/crmeb-service/src/main/java/com/zbkj/service/service/impl/OrderServiceImpl.java#L2100-L2109"
},
{
"name": "VulnCheck Advisory: crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crmeb-java-through-3.1-authorization-bypass-via-front-order-express-and-refund-endpoints"
}
],
"title": "crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111354",
"datePublished": "2026-10-15T21:43:43.756Z",
"dateReserved": "2026-10-15T20:55:54.958Z",
"dateUpdated": "2026-10-16T14:21:47.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111351 (GCVE-0-2026-111351)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 16:47
VLAI
EPSS
VEX
Title
metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API
Summary
metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:47 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/metasfresh-board… | third-party-advisory |
| https://github.com/metasfresh/metasfresh/blob/5.1… | technical-description |
| https://github.com/metasfresh/metasfresh/blob/56d… | technical-description |
| https://github.com/metasfresh/metasfresh | product |
| https://www.vulncheck.com/advisories/metasfresh-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| metasfresh | metasfresh |
Affected:
0 , ≤ 5.175
(custom)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111351",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:47:06.060888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:47:40.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/metasfresh-board-rest-missing-record-authz"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/metasfresh/metasfresh",
"product": "metasfresh",
"repo": "https://github.com/metasfresh/metasfresh",
"vendor": "metasfresh",
"versions": [
{
"lessThanOrEqual": "5.175",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:41.617Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/metasfresh-board-rest-missing-record-authz"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/metasfresh/metasfresh/blob/5.175/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardRestController.java#L137-L220"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/metasfresh/metasfresh/blob/56dd881b972af4edb071e4f1261a55a8b1a9c4d7/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/board/BoardDescriptorRepository.java#L473-L511"
},
{
"tags": [
"product"
],
"url": "https://github.com/metasfresh/metasfresh"
},
{
"name": "VulnCheck Advisory: metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/metasfresh-through-5.175-authorization-bypass-via-rest-api-board-rest-api"
}
],
"title": "metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111351",
"datePublished": "2026-10-15T21:43:41.617Z",
"dateReserved": "2026-10-15T20:54:36.303Z",
"dateUpdated": "2026-10-16T16:47:40.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111348 (GCVE-0-2026-111348)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-15 21:43
VLAI
EPSS
VEX
Title
Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
Summary
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
Severity
5.4 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/likeshop-after-s… | third-party-advisory |
| https://github.com/likeadmin-likeshop/likeshop/bl… | technical-description |
| https://github.com/likeadmin-likeshop/likeshop/bl… | technical-description |
| https://github.com/likeadmin-likeshop/likeshop | product |
| https://www.vulncheck.com/advisories/likeshop-thr… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/likeadmin-likeshop/likeshop",
"product": "likeshop",
"repo": "https://github.com/likeadmin-likeshop/likeshop",
"vendor": "likeshop",
"versions": [
{
"lessThanOrEqual": "3.5.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:likeshop:likeshop:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers\u0027 after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:39.350Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/likeshop-after-sale-api-cross-user-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/controller/AfterSale.php#L52-L102"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/logic/AfterSaleLogic.php#L251-L377"
},
{
"tags": [
"product"
],
"url": "https://github.com/likeadmin-likeshop/likeshop"
},
{
"name": "VulnCheck Advisory: Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/likeshop-through-3.5.1-idor-via-aftersale-api-refund-endpoints"
}
],
"title": "Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111348",
"datePublished": "2026-10-15T21:43:39.350Z",
"dateReserved": "2026-10-15T20:54:23.872Z",
"dateUpdated": "2026-10-15T21:43:39.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.