CVE-2026-97898
HighCVSS 8.4Summary
The Akia keyless entry cloud service is vulnerable to Insecure Direct Object Reference (IDOR) / missing object-level authorization. The unlock action relies on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property. As of 19th September 2026 the service is no longer vulnerable to this attack (feedback received by the reporter). The attack is remote but the effect is local to an affected property.
Risk Assessment
A guest can gain unauthorized physical access to other guests' rooms, posing a serious threat to personal safety and privacy.
Recommendation
Ensure the Akia service has been updated to a version resistant to this attack (fix deployed by 19th September 2026). Implement server-side verification that the room/door identifier belongs to the authenticated guest's booking.
Related vulnerabilities
- CVE-2026-115995Critical
A vulnerability was detected in Unitree Robotics Unitree Go2 up to version 1.1.11.4. The set_volume function in gpt_thread.py of the chat_go component mishandles the Value argument, leading to OS command injection. The attack can be launched remotely, and upgrading to version 1.1.11.5 resolves the issue.
- CVE-2026-114820Critical
Vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It is easily exploitable by an unauthenticated attacker with network access, leading to unauthorized creation, deletion, or modification of critical data as well as unauthorized access to critical data. The vulnerability also applies to Java deployments that load and run untrusted code in a sandbox (e.g., Java Web Start applications or applets).
- CVE-2026-115933Critical
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back, allowing a user to obtain a validly signed token containing any claims they choose, accepted as a session, an organization invitation with a chosen role, a password reset or an enterprise provisioning token.
- CVE-2026-115557Critical
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
- CVE-2026-115932Critical
In Postiz, a media path that is not a web address is treated as a file on the server's disk without verifying it lies inside the upload directory. A registered user can store a crafted media path with a post and cause the publishing worker to read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads are reachable through two further routes, including file existence checks and backend memory exhaustion; self-registration is open by default.
- CVE-2026-94075Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 contains a deserialization of untrusted data vulnerability, allowing object injection. This could enable an attacker to execute unintended code.
- CVE-2026-114196Critical
The WordPress plugin Paytium up to version 5.0.5 is vulnerable to deserialization of untrusted data, allowing object injection. This may enable an attacker to perform unauthorized actions.
- CVE-2026-112866Critical
The WordPress plugin Product Filter by WBW (woo-product-filter) up to version 3.4.6 is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker could exploit this to manipulate database queries.
- CVE-2026-111402Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This could allow an attacker to execute arbitrary SQL queries.
- CVE-2026-110956Critical
The asVereinbase WordPress plugin before version 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match. This allows an unauthenticated attacker to log in as any user, including an administrator.
Original NVD description (English source)
Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property. As of 19th September 2026 the service is no more vulnerable to this attack (feedback received by the reporter). The attack is remote but the effect is local to an affected property.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS