CVE-2026-123861

MediumCVSS 5.3/10Last modified Nov 7, 2026

Description

Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
CrocoBlock	JetFormBuilder – Hierarchical Select	<= 1.0.10

References

https://patchstack.com/database/wordpress/plugin/jet-form-builder-hierarchical-select/vulnerability/wordpress-jetformbuilder-hierarchical-select-plugin-1-0-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve

Timeline

Published: Nov 7, 2026
Last modified: Nov 7, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1238622.9An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib CVE-2026-1238638.2A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A cl CVE-2026-1238648.1A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys an CVE-2026-1238657.5An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for e CVE-2026-1238667.5A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, CVE-2026-1238674.2A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not CVE-2026-1238685.9An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no sessi CVE-2026-123875.1Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture K CVE-2026-1238709.5The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOO CVE-2026-1238716.2Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not CVE-2026-1238728.1A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoint CVE-2026-1238747.5A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves