CYBERHAWK / CVE / CVE-2026-53673
CVE-2026-53673
HIGH
CVSS 8.1
other
The flaw
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers
What to do
Review advisory and patch per vendor guidance.