Objects API: Cross-object-type authorization bypass on the object history-detail endpoint

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-82411 · Microsoft / collected KEV context

cve-program · CVE-2026-82411

• https://github.com/maykinmedia/open-object/security/advisories/GHSA-55w6-rqp5-j5wx
• https://github.com/maykinmedia/open-object/commit/11c5b85ea5d1d80f940883f01b8b8ea80ccdd47c
• https://github.com/maykinmedia/open-object/commit/27e806eff04c52ebe1e78126c288b63fc0308b52
• https://github.com/maykinmedia/open-object/commit/6154d9c2ed8c162b61f2d42db2de4eda5081347f
• https://github.com/maykinmedia/open-object/commit/ce6b1820619c843748bc5231597aa7fc060d95fe
• https://github.com/maykinmedia/open-object/tree/2.5.1
• https://github.com/maykinmedia/open-object/tree/3.6.2
• https://github.com/maykinmedia/open-object/tree/4.0.2
• https://github.com/maykinmedia/open-object/tree/4.1.1

• Objects API: Cross-object-type authorization bypass on the object history-detail endpoint · Newly collected advisory · 28 Oct 2026