CVE-2026-57676

Name of the Vulnerable Software and Affected Versions Simple User Avatar versions prior to 5.0

Description An authorization bypass exists due to a user-controlled key, which allows the exploitation of incorrectly configured access control security levels. This issue is characterized as an Insecure Direct Object Reference (IDOR), a condition where an application provides direct access to objects based on user-supplied input without sufficient authorization checks.

Recommendations Update Simple User Avatar to a version newer than 4.9.