CVE-2026-23754

D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credential material can be reused directly as a valid authentication secret, allowing full impersonation of the targeted account. This results in complete account takeover and full administrative control over the D-View system.

• CWE-639

• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10471Patch, Vendor Advisory
• https://www.vulncheck.com/advisories/dlink-dview-8-idor-allows-credential-disclosure-and-account-takeoverThird Party Advisory

Published

Jan 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23749Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed i…2.9
• CVE-2026-2375The App Builder – Create Native Android & iOS Apps On The Fl…6.5
• CVE-2026-23750Golioth Pouch version 0.1.0, prior to commit 1b2219a1, conta…8.1
• CVE-2026-23751Kofax Capture, now referred to as Tungsten Capture, version …9.8
• CVE-2026-23752GFI HelpDesk before 4.99.9 contains a stored cross-site scri…4.8
• CVE-2026-23753GFI HelpDesk before 4.99.9 contains a stored cross-site scri…4.8
• CVE-2026-23755D-Link D-View 8 versions 2.0.1.107 and below contain an unco…7.3
• CVE-2026-23756GFI HelpDesk before 4.99.9 contains a stored cross-site scri…5.4
• CVE-2026-23757GFI HelpDesk before 4.99.10 contains a stored cross-site scr…5.4
• CVE-2026-23758GFI HelpDesk before 4.99.9 contains a stored cross-site scri…5.4
• CVE-2026-23759Perle IOLAN STS/SCS terminal server models with firmware ver…8.6
• CVE-2026-2376A flaw was found in mirror-registry where an authenticated u…5.4