PT-2026-136852

CVE-2026-110964

Published

2026-11-04

Updated

2026-11-04

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Essential Real Estate versions 4.4.3 through 5.3.4

Description An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. This allows an authenticated user with subscriber or customer-level access to delete media library attachments belonging to other users, including those owned by administrators, without verifying ownership of the media attachment.

Recommendations Update Essential Real Estate to version 5.3.5 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Sungbyeongchan

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers