CVE-2026-111722High· 8.1▾ MidnightPoC availableLingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.
LingGuo-Drama <= 8a6924adf8142678919b4d9a08b9d60c49dcfbedRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111723High· 8.8LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API
CVE-2021-46416High· 8.1Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
CVE-2026-103988Medium· 5.4FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-102986High· 8.1Plane is an open-source project management tool
CVE-2026-102980Medium· 6.5Plane is an open-source project management tool
CVE-2026-102663Medium· 4.3OpenList is a file list program that supports multiple storage backends