CVE-2026-110762

LowCVSS 3.7/10Last modified Oct 15, 2026

Description

bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1107634.3lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDCVE-2026-1107645.3AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that alloCVE-2026-1107655.9FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when tCVE-2026-1107664.3Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplCVE-2026-1107677.5Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated atCVE-2026-1107684.8holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders bCVE-2026-1107698.6holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform usCVE-2026-110778.8Bad cast in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted CVE-2026-1107708.1Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force passwordCVE-2026-1107714.3Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customersCVE-2026-1107724.3Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows faCVE-2026-1107734.3GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list