CVE-2026-62061: IDOR in ProfileGrid

Status: fixed in 6.0.0.3. Advisory published by Patchstack, credited to Zenith.

This is a stub with the public advisory facts. The full writeup — with PoC, evidence and the fix — will be published here. I won’t invent technical detail that isn’t documented yet.

Advisory summary

• CVE: CVE-2026-62061
• Product: ProfileGrid
• Affected versions: <= 6.0.0.2
• Type: IDOR (CWE-639)
• CVSS: 5.3
• Fixed in: 6.0.0.3
• Advisory: Patchstack
• Credit: Zenith

{
  "cve": "CVE-2026-62061",
  "product": "ProfileGrid",
  "affected": "<= 6.0.0.2",
  "type": "IDOR (CWE-639)",
  "cvss": 5.3,
  "fixed": "6.0.0.3",
  "source": "Patchstack",
  "credit": "Zenith"
}

Coming next

• the access flow that allows reading or changing another user’s object;
• lab testing with a negative control;
• the 6.0.0.3 patch excerpt;
• what to check on installs running the plugin.

References

• CVE.org record
• Patchstack advisory (published in their database)
• Fixed version: ProfileGrid 6.0.0.3

In progress: PoC, evidence and the patch diff will be published here.