Se1En

**Name of the Vulnerable Software and Affected Versions** Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.55.0.3 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to enumerate sequential integer entry IDs using the `draft` parameter to read saved draft form data from other users, including names, email addresses, phone numbers, addresses, and free-form message content. This issue is only exploitable on forms where the Save and Continue feature is enabled. **Recommendations** Update the plugin to a version newer than 1.55.0.2. As a temporary mitigation, disable the Save and Continue feature on all forms to prevent the exploitation of the `draft` parameter.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.7.0 through 11.7.2 Mattermost versions 11.6.0 through 11.6.4 Mattermost versions 10.11.0 through 10.11.19 **Description** An issue exists where the system fails to restrict the `group constrained` channel flag to public and private channels that support group synchronization. This allows a standard member of a group or direct message to remove all other participants from the conversation by interacting with the channel patch API endpoint. **Recommendations** Update Mattermost versions 11.7.0 through 11.7.2 to a version newer than 11.7.2. Update Mattermost versions 11.6.0 through 11.6.4 to a version newer than 11.6.4. Update Mattermost versions 10.11.0 through 10.11.19 to a version newer than 10.11.19.

**Name of the Vulnerable Software and Affected Versions** Kadence Blocks — Page Builder Toolkit for Gutenberg Editor versions prior to 3.7.8 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can bypass the `upload files` capability boundary to create arbitrary Media Library attachments. This is achieved by downloading remote images to the site's uploads directory using the `wp upload bits()` and `wp insert attachment()` functions. **Recommendations** Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to version 3.7.8 or later.

**Name of the Vulnerable Software and Affected Versions** Kadence Blocks – Gutenberg Blocks for Page Builder Features versions prior to 3.7.8 **Description** An Insecure Direct Object Reference exists due to a mismatch between the object used for authorization and the object accessed in the `Optimize Rest Controller`'s `create item()`, `get item()`, `delete item()`, and `bulk delete items()` endpoints. While authorization is verified using `current user can('edit post'/'delete post', $post id)` against the `post id` parameter, the storage layer retrieves records based on a SHA256 hash of the `post path` parameter. Because there is no enforcement ensuring that `post path` corresponds to the `post id`, authenticated attackers with Contributor-level access or higher can read or delete optimizer analysis records of posts owned by other users by providing their own `post id` and the victim's `post path`. **Recommendations** Update to a version newer than 3.7.7.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 **Description** An issue exists where the system fails to enforce the `PostEditTimeLimit` on non-message post fields. This allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired by using the post patch and update API endpoints. **Recommendations** Update Mattermost versions 11.5.0 through 11.5.1 to a version newer than 11.5.1. Update Mattermost versions 10.11.0 through 10.11.13 to a version newer than 10.11.13.

**Name of the Vulnerable Software and Affected Versions** Grafana (affected versions not specified) **Description** A time-of-create-to-time-of-use (TOCTOU) issue allows re-deletion of recently deleted and recreated data sources without authorization. The attack requires specific conditions: admin access to the data source before initial deletion, all steps completed within 30 seconds on the same Grafana pod, recreation of the data source by another user, the new data source having the same UID as the previous one, and the attacker not being an admin of the new data source. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** versions prior to 2026-21721 **Description** The dashboard permissions API does not verify the target dashboard scope, only checking the `dashboards.permissions:*` action. This allows a user with permission management rights on one dashboard to read and modify permissions on other dashboards, resulting in a privilege escalation. The API endpoint in question is the dashboard permissions API. The vulnerable action is `dashboards.permissions:*`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.