# User Registration & Membership. Every CVE that names User Registration & Membership among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [User Registration & Membership < 5.3.2 - Unauthenticated Payment Before Login Bypass via Omitted Membership Field](https://agentprime.io/advisories/CVE-2026-109873.md) `CVE-2026-109873` · CVE record: Unknown User Registration & Membership · CVSS 5.3 Medium · Not analysed yet · Published 11 Nov 2026 · Tags: Authentication bypass - [User Registration & Membership < 5.3.2 - Subscriber+ Payment Bypass via Membership Renewal](https://agentprime.io/advisories/CVE-2026-109871.md) `CVE-2026-109871` · CVE record: Unknown User Registration & Membership · CVSS 4.3 Medium · Not analysed yet · Published 11 Nov 2026 · Tags: Broken access control - [User Registration & Membership 5.2.8 - 5.3.1 - Unauthenticated Privilege Escalation via Coupon-Based Payment Bypass](https://agentprime.io/advisories/CVE-2026-109870.md) `CVE-2026-109870` · CVE record: Unknown User Registration & Membership · CVSS 8.1 High · Not analysed yet · Published 11 Nov 2026 · Tags: Privilege escalation - [User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page](https://agentprime.io/advisories/CVE-2026-86407.md) `CVE-2026-86407` · CVE record: Unknown User Registration & Membership · CVSS 3.7 Low · Not analysed yet · Published 13 Sept 2026 · Tags: Information disclosure - [User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase](https://agentprime.io/advisories/CVE-2026-86406.md) `CVE-2026-86406` · CVE record: Unknown User Registration & Membership · CVSS 7.5 High · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation - [User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters](https://agentprime.io/advisories/CVE-2026-80072.md) `CVE-2026-80072` · CVE record: Unknown User Registration & Membership · CVSS 4.7 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Open redirect - [User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator](https://agentprime.io/advisories/CVE-2026-80071.md) `CVE-2026-80071` · CVE record: Unknown User Registration & Membership · CVSS 7.2 High · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation - [User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings](https://agentprime.io/advisories/CVE-2026-79996.md) `CVE-2026-79996` · CVE record: Unknown User Registration & Membership · CVSS 7.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Privilege escalation - [User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR](https://agentprime.io/advisories/CVE-2026-79995.md) `CVE-2026-79995` · CVE record: Unknown User Registration & Membership · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Broken access control - [User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled](https://agentprime.io/advisories/CVE-2026-16736.md) `CVE-2026-16736` · CVE record: Unknown User Registration & Membership · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Broken access control - [User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler](https://agentprime.io/advisories/CVE-2026-11966.md) `CVE-2026-11966` · CVE record: Unknown User Registration & Membership · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control - [User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID](https://agentprime.io/advisories/CVE-2026-11961.md) `CVE-2026-11961` · CVE record: Unknown User Registration & Membership · CVSS 8.1 High · Not analysed yet · Published 17 Jul 2026 · Tags: Privilege escalation - [User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation](https://agentprime.io/advisories/CVE-2026-11964.md) `CVE-2026-11964` · CVE record: Unknown User Registration & Membership · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 - [User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR](https://agentprime.io/advisories/CVE-2026-11963.md) `CVE-2026-11963` · CVE record: Unknown User Registration & Membership · CVSS 8.1 High · Not analysed yet · Published 13 Jul 2026 - [User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership Bypass](https://agentprime.io/advisories/CVE-2026-11965.md) `CVE-2026-11965` · CVE record: Unknown User Registration & Membership · CVSS 6.5 Medium · Not analysed yet · Published 2 Jul 2026 - [User Registration & Membership < 4.1.3 - Authentication Bypass](https://agentprime.io/advisories/CVE-2025-2594.md) `CVE-2025-2594` · CVE record: Unknown User Registration & Membership · CVSS 8.1 High · Not analysed yet · Published 22 Apr 2025 - [User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation](https://agentprime.io/advisories/CVE-2025-2563.md) `CVE-2025-2563` · CVE record: Unknown User Registration & Membership · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.49 · Not analysed yet · Published 14 Apr 2025 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .