Idor — PoC Archivehttps://poc.intelseclab.com/tags/idor/Latest proof-of-concept entries.Hugoen-usSun, 19 Jul 2026 00:00:00 +0000Langflow Responses API IDOR — Execute Another User's Flow (CVE-2026-55255)https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-55255-langflow-responses-api-idor/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-55255-langflow-responses-api-idor/High severity (CVSS 8.4) — web · CVE-2026-55255 (GHSA-qrpv-q767-xqq2). Status: Weaponized — confirmed cross-user flow execution via a minimal request-only PoC. Affects: Langflow — open-source platform for building and deploying AI-powered agents and workflows (langflow-ai/langflow), OpenAI-compatible Responses API. Tags: langflow, ai-agent-framework, idor, cwe-639, authenticated, remote, cross-tenant, kev.webHighlangflowai-agent-frameworkidorcwe-639authenticatedremotecross-tenantkevWordPress Download Manager 3.3.5.2 — Unauthenticated IDOR (CVE-2026-39676)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39676-wordpress-download-manager-idor/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-39676-wordpress-download-manager-idor/Medium severity — web · CVE-2026-39676. Status: PoC. Affects: Download Manager plugin for WordPress. Tags: wordpress, wordpress-plugin, idor, missing-authorization, unauthenticated, download-manager.webMediumwordpresswordpress-pluginidormissing-authorizationunauthenticateddownload-managerVaultwarden Organization Collection Permissions Bypass & Cipher Enumeration (CVE-2026-26012)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26012-vaultwarden-collection-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26012-vaultwarden-collection-bypass/Medium severity (CVSS 6.5) — web · CVE-2026-26012 (GHSA-h265-g7rm-h337). Status: PoC. Affects: Vaultwarden (unofficial Bitwarden-compatible server). Tags: vaultwarden, bitwarden, password-manager, idor, access-control-bypass, api, cipher-enumeration, self-hosted.webMediumvaultwardenbitwardenpassword-manageridoraccess-control-bypassapicipher-enumerationself-hostedSaleor GraphQL IDOR — Unauthenticated Order PII Exfiltration (CVE-2026-24136)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24136-saleor-graphql-idor/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24136-saleor-graphql-idor/High severity (CVSS 7.5) — web · CVE-2026-24136. Status: PoC. Affects: Saleor e-commerce platform (GraphQL API). Tags: saleor, graphql, idor, bola, cwe-639, pii-leak, unauthenticated, e-commerce.webHighsaleorgraphqlidorbolacwe-639pii-leakunauthenticatede-commerceEventin (wp-event-solution) Broken Access Control / IDOR (CVE-2026-40776)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40776-eventin-broken-access-control/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40776-eventin-broken-access-control/High severity (CVSS 7.5) — web · CVE-2026-40776 / Patchstack PSID 85de025d71e7. Status: PoC. Affects: Eventin — Events Calendar, Event Booking, Ticket & Registration (wp-event-solution WordPress plugin). Tags: wordpress, wordpress-plugin, broken-access-control, idor, nonce-misuse, cwe-862, pii-disclosure, unauthenticated.webHighwordpresswordpress-pluginbroken-access-controlidornonce-misusecwe-862pii-disclosureunauthenticatedAutoGPT Platform Chat Session IDOR / Session Hijack — CVE-2026-30950https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30950-autogpt-session-idor/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30950-autogpt-session-idor/High severity (CVSS 7.1) — web · CVE-2026-30950 (GHSA-q58p-v9r9-7gqj). Status: PoC. Affects: AutoGPT Platform (autogpt-platform-backend, chat/copilot feature). Tags: autogpt, idor, cwe-862, session-hijack, missing-authorization, python, fastapi, redis.webHighautogptidorcwe-862session-hijackmissing-authorizationpythonfastapiredis