CVE-2026-81021

MediumCVSS 5.3/10Last modified Sep 9, 2026

Description

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2026
Last modified
Sep 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-810225.3The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code CVE-2026-810264.8The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment nCVE-2026-810278.5one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel eitherCVE-2026-810284.9ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directorCVE-2026-810298.1OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the caCVE-2026-810306.5Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/CVE-2026-810317.2IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in bCVE-2026-810329.8NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webserCVE-2026-810335.3Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backendCVE-2026-810346.5Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS coCVE-2026-810358.1Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the teCVE-2026-810368.1Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validati
CVE-2026-81021: Medium severity, CVSS 5.3 | Vulnix