https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:18:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326479 EUVD-2026-326479 https://cve.radiocsirt.org/vuln/euvd-2026-326479 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53673 <p>BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user&#39;s identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user&#39;s private messages.</p> <p>BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user&#39;s identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user&#39;s private messages.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53673 https://cve.radiocsirt.org/vuln/ghsa-j3j5-5m8v-7gvc <p><strong>Affected:</strong> Packagist: buddypress/buddypress</p> <p>BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user&#39;s identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user&#39;s private messages.</p> <p><strong>Affected:</strong> Packagist: buddypress/buddypress</p> <p>BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user&#39;s identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user&#39;s private messages.</p> https://cve.radiocsirt.org/vuln/ghsa-j3j5-5m8v-7gvc