CVE-2026-81279
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
CVSS
5.4
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Aug 27, 2026 · Last modified: Aug 27, 2026 · CWE-862
Not enough EPSS history yet.
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-65931——
———LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint.
An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface and intended update workflow restrict for non-superadministrators, enabling unauthorized changes to administrative navigation records.
This issue affects LimeSurvey: 7.0.5.5hCVE-2026-81819——
———Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication.
As a result, a lower-privileged authenticated user could potentially query another user’s assignment information by supplying that user’s identifier.
The fix changes:
method_decorators = [api_required]
to:
method_decorators = [admin_or_org_admin_required, api_required]
so only administrators or organization administrators can perform cross-user assignment queries.
Version impacted =>3.3.05hCVE-2026-813357.5 HIG—
———Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits any caller, so a request carrying no credential reaches the handler. DataSourceService.dispatch_data_sources in backend/src/baserow/contrib/builder/data_sources/service.py then calls check_multiple_permissions without asking it to raise, and neither stores nor examines the mapping of denials it returns, so a denied check leaves execution to continue and the data source is dispatched whatever the caller's identity. The dispatch runs with the integration's own credentials, so an unauthenticated request naming a data source receives the rows and fields that source reads. Identifiers are small integers and can be enumerated. Version 2.3.1 passes raise_exception to the same call.5hCVE-2026-812765.3 MED—
———Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.15hCVE-2026-812745.3 MED—
———Subscriber Broken Access Control in Ditty <= 3.1.67 versions.12hCVE-2026-812724.9 MED—
———Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.12h