Back to all advisories

Tag: IDOR

1 advisory tagged with "IDOR".

CVE-2026-35183 High

Insecure Direct Object Reference in Article Image Deletion

BraveCMS 2.0.0 contains an Insecure Direct Object Reference (IDOR) in the article image deletion endpoint. Any authenticated user with article-edit permissions can delete images attached to articles owned by other users by tampering with the filename and article ID in the URL.

BraveCMS

Start securing your codebase today

Connect your repositories and let AI agents handle continuous scanning, research, and triage.

Create free account Sign in
Have questions? Get in touch →

A short note when we publish new security research. No noise. Unsubscribe anytime.