CTF
2026.09.29 > SunshineCTF 2026
Used Goods of Tomorrow
GraphQL introspection exposes an unauthenticated vendor key and an internal 100% discount.
Read Writeup CTF_ENTRY
~/research/tags/#Broken Access Control
> #Broken Access Control
7 RESEARCH ENTRIES
2026.08.27 CVE-2026-78259
WPLegalPages API Secret Disclosure and Account Disconnect via Unauthenticated REST API
Unauthenticated WPLegalPages <= 3.6.4 REST endpoints disclose API secrets and allow attackers to disconnect the connected account.
Read Advisory SECREPORT
2026.07.30 CVE-2026-59557
Events Made Easy Arbitrary Person Record Modification Without Login
Broken access control in Events Made Easy <= 3.0.67 lets unauthenticated attackers modify arbitrary person records through the public personal-information AJAX endpoint.
Read Advisory SECREPORT
2026.07.20 CVE-2026-57341
Colissimo Officiel Unauthenticated Shipping Rate Tampering
Broken authentication in Colissimo Officiel <= 2.9.0 exposes shipping-rate import/export actions to unauthenticated visitors via the shared admin-ajax dispatcher.
Read Advisory SECREPORT
2026.06.21 CVE-2026-54840
Newsletters Unauthenticated Subscriber Management Account Takeover
Broken access control in Newsletters <= 4.13 lets an unauthenticated attacker take over any subscriber's management account via a predictable md5(id) token.
Read Advisory SECREPORT
2026.06.18 CVE-2026-54804
Melhor Envio Subscriber API Token Disclosure and Overwrite
Broken authentication in Melhor Envio <= 2.16.3 lets a low-privilege Subscriber read and overwrite the store's Melhor Envio API tokens.
Read Advisory SECREPORT
2026.06.10 CVE-2026-42743
Masteriyo LMS Lemon Squeezy Webhook Forgery
Broken authentication in Masteriyo LMS 2.1.8 allows unauthenticated attackers to forge Lemon Squeezy webhooks and mark pending orders as paid.
Read Advisory SECREPORT