PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-22588] Tales From the Trace: How XBOW Reasons Its Way Into Finding IDORs

xbow.com | blog | CVE-2026-22588 | #agentic-ai | #appsec | #vulnerability-research | #idor | #cve | #ai-pentesting | #authorization | #spree
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Walks through XBOW traces that found two IDORs in the Spree e-commerce framework (CVE-2026-22588/22589, patched in v5.2.5) by reasoning about objects and authorization states.
CVE
CVE-2026-22588
Published
Collected

Related coverage

blog · xbow.com
Legal Boundaries of AI Penetration Testing: Engagements, Laws & Permissions
A practitioner's guide to the legal boundaries of autonomous AI pentesting: why traditional authorization breaks down, and how scope, enforceable controls and evidence preservation should be designed.
blog · xbow.com
Getting to “Should I?”, Instead of “Can I?”: How XBOW Finds IDORs With High Accuracy in Ambiguous Contexts
XBOW explains why IDORs are design flaws that scanners miss, and how its context-aware reasoning models expected access patterns to find high-accuracy IDORs in ambiguous authorization contexts.
blog · bugcrowd.com
How-To: Find IDOR (Insecure Direct Object Reference) Vulnerabilities for Large Bounty Rewards
Guest researchers Mert and Evren explain how IDOR lets attackers manipulate id or uid parameters to access other users' objects, and share testing tips using browser session isolation and Burp Suite.
blog · bugbunny.ai
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
Insecure direct object reference: the app exposes an object ID but never checks ownership, tenant or role—one user reads another's data; fix with centralized object authorization and negative tests.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
blog · xbow.com
Don't Make It Easy for Attackers: 5 Common AppSec Gaps
Discover five common AppSec gaps that give attackers an advantage and learn how better testing, validation, and remediation can reduce exploitable risk.
Back