Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

3307 vulnerabilities reference this CWE, most recent first.

GHSA-FV85-H58G-9X8P

Vulnerability from github – Published: 2024-12-13 09:31 – Updated: 2024-12-13 09:31
VLAI
Details

The Rate My Post – Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.4 via the get_post_status() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to vote on unpublished scheduled posts.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-12309"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-13T09:15:07Z",
    "severity": "MODERATE"
  },
  "details": "The Rate My Post \u2013 Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.4 via the get_post_status() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to vote on unpublished scheduled posts.",
  "id": "GHSA-fv85-h58g-9x8p",
  "modified": "2024-12-13T09:31:14Z",
  "published": "2024-12-13T09:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12309"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3206801/rate-my-post/trunk/public/class-rate-my-post-public.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9aa467f-9ac2-4a84-b0bb-761101733af7?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FV9X-WJCX-9CGM

Vulnerability from github – Published: 2025-05-07 18:30 – Updated: 2025-05-07 18:30
VLAI
Details

A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data.

This vulnerability exists because a subtle change in inner API call behavior causes results to be filtered incorrectly. An attacker could exploit this vulnerability by using either NETCONF, RESTCONF, or gRPC Network Management Interface (gNMI) protocols and query data on paths that may have been denied by the NACM configuration. A successful exploit could allow the attacker to access data that should have been restricted according to the NACM configuration.

Note: This vulnerability requires that the attacker obtain the credentials from a valid user with privileges lower than 15, and that NACM was configured to provide restricted read access for that user.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-20214"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-07T18:15:41Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data.\n\n This vulnerability exists because a subtle change in inner API call behavior causes results to be filtered incorrectly. An attacker could exploit this vulnerability by using either NETCONF, RESTCONF, or gRPC Network Management Interface (gNMI) protocols and query data on paths that may have been denied by the NACM configuration. A successful exploit could allow the attacker to access data that should have been restricted according to the NACM configuration.\n\n Note: This vulnerability requires that the attacker obtain the credentials from a valid user with privileges lower than 15, and that NACM was configured to provide restricted read access for that user.",
  "id": "GHSA-fv9x-wjcx-9cgm",
  "modified": "2025-05-07T18:30:49Z",
  "published": "2025-05-07T18:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20214"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-netconf-nacm-bypass-TGZV9pmQ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FVM9-C9QF-H767

Vulnerability from github – Published: 2025-04-16 00:31 – Updated: 2025-04-16 00:31
VLAI
Details

An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-27575"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-15T22:15:20Z",
    "severity": "MODERATE"
  },
  "details": "An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.",
  "id": "GHSA-fvm9-c9qf-h767",
  "modified": "2025-04-16T00:31:37Z",
  "published": "2025-04-16T00:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27575"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-FVWX-GHWG-3RM3

Vulnerability from github – Published: 2026-04-29 09:30 – Updated: 2026-04-29 09:30
VLAI
Details

This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system.

Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-42516"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-29T09:16:24Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system.",
  "id": "GHSA-fvwx-ghwg-3rm3",
  "modified": "2026-04-29T09:30:24Z",
  "published": "2026-04-29T09:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42516"
    },
    {
      "type": "WEB",
      "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2026-0207"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-FX87-FVWQ-55WG

Vulnerability from github – Published: 2023-06-09 06:30 – Updated: 2024-04-04 04:41
VLAI
Details

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of arbitrary form submissions that included payment.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-0693"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-09T06:15:51Z",
    "severity": "MODERATE"
  },
  "details": "The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the \u0027mf_transaction_id\u0027 shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of arbitrary form submissions that included payment.",
  "id": "GHSA-fx87-fvwq-55wg",
  "modified": "2024-04-04T04:41:10Z",
  "published": "2023-06-09T06:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0693"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/metform/trunk/base/shortcode.php?rev=2845078"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2910040"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f33a8db-7cd0-4a53-b2c1-cd5b7cd16214?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FXP3-G6GW-4R4V

Vulnerability from github – Published: 2026-02-09 20:36 – Updated: 2026-02-09 22:39
VLAI
Summary
Craft CMS: GraphQL Asset Mutation Privilege Escalation
Details

There is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their privileges and modify/transfer assets belonging to any other volume, including restricted or private volumes to which they should not have access.

Summary:

Type: Privilege Escalation (CWE-269) Affected: Craft CMS 5.x (likely affects 4.x and 3.x as well) Location: src/gql/resolvers/mutations/Asset.php lines 57-107

Root Cause:

The saveAsset GraphQL mutation validates authorization against the schema-resolved volume but fetches the target asset by ID without verifying that the asset belongs to the authorized volume. This allows unauthorized cross-volume asset modification and transfer.

Impact:

  • Transfer confidential assets from private volumes to public volumes (data exfiltration)
  • Modify asset metadata in restricted volumes
  • Bypass multi-tenant isolation in shared hosting environments
Severity
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.9.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.17.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25497"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-09T20:36:24Z",
    "nvd_published_at": "2026-02-09T20:15:58Z",
    "severity": "HIGH"
  },
  "details": "There is a Privilege Escalation vulnerability in Craft CMS\u2019s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their privileges and modify/transfer assets belonging to any other volume, including restricted or private volumes to which they should not have access.\n\n## Summary:\n\nType: Privilege Escalation (CWE-269)\nAffected: Craft CMS 5.x (likely affects 4.x and 3.x as well)\nLocation: `src/gql/resolvers/mutations/Asset.php lines 57-107`\n\n## Root Cause:\n\nThe saveAsset GraphQL mutation validates authorization against the schema-resolved volume but fetches the target asset by ID without verifying that the asset belongs to the authorized volume. This allows unauthorized cross-volume asset modification and transfer.\n\n## Impact:\n\n- Transfer confidential assets from private volumes to public volumes (data exfiltration)\n- Modify asset metadata in restricted volumes\n- Bypass multi-tenant isolation in shared hosting environments",
  "id": "GHSA-fxp3-g6gw-4r4v",
  "modified": "2026-02-09T22:39:11Z",
  "published": "2026-02-09T20:36:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-fxp3-g6gw-4r4v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25497"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/ac7edf868c1a81fd9c4dc49d3b3edf1cce113409"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/4.17.0-beta.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/5.8.22"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/5.9.0-beta.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS: GraphQL Asset Mutation Privilege Escalation"
}

GHSA-G22G-H6V3-25JW

Vulnerability from github – Published: 2026-03-31 12:31 – Updated: 2026-03-31 12:31
VLAI
Details

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb_save_avatar_value() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to reassign ownership of arbitrary posts and attachments by changing 'post_author'.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-3139"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-31T12:16:31Z",
    "severity": "MODERATE"
  },
  "details": "The User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles \u0026 User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb_save_avatar_value() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to reassign ownership of arbitrary posts and attachments by changing \u0027post_author\u0027.",
  "id": "GHSA-g22g-h6v3-25jw",
  "modified": "2026-03-31T12:31:36Z",
  "published": "2026-03-31T12:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3139"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3481772/profile-builder"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/760f7736-db49-4210-a2f3-3abb506106d7?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G268-72P7-9J6J

Vulnerability from github – Published: 2026-01-08 21:27 – Updated: 2026-01-11 14:57
VLAI
Summary
Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification
Details

Summary

An Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying an existing order. By editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker’s order and returning them in the response.

Details

Affected Component(s) - Authenticated user order management - Address association logic - Order update endpoint(s) Affected Endpoint(s): - /api/v2/storefront/checkout

The application fails to enforce proper object-level authorization when updating an existing order. While the user is authenticated and authorized to modify their own order, the backend does not verify that the supplied address identifiers belong to the same authenticated user.

PoC

Preconditions - Valid authenticated user account

Step 1: Log-in using a valid user, in this case customer2@example.com Step 2: Visualize current user’s addresses

Request GET /account/addresses

The following screenshot shows customer2@example.com address.

User Address

Step 3: Initialize the Shopping Cart

Request POST /api/v2/storefront/cart HTTP/1.1

From the response, extract the token marked in bold.

Step 4: Legitimate Order Edit Request

Using the obtained order token A1cram_6cFWpoj4V1yPkuQ1767113871701 perform an edit order request in order to add a custom billing address

Request PATCH /api/v2/storefront/checkout

{
    "include": "billing_address",
    "order": {
      "email": "idor_test@example.com",
      "bill_address_attributes": {
        "firstname":"CTF","lastname":"Tester","address1":"123 Main St",
        "city":"Andorra la Vella","zipcode":"AD100","country_iso":"AD"
      },
      "ship_address_attributes": {
        "firstname":"CTF","lastname":"Tester","address1":"123 Main St",
        "city":"Andorra la Vella","zipcode":"AD100","country_iso":"AD"
      }
    }
  }

Step 5: Modify the order request to include the other user's address and trigger the IDOR.

In this request, the attacker modifies the request by substituting the address identifier with one belonging to another user, thereby rendering the original address identifier accessible to the attacker.

Request PATCH /api/v2/storefront/checkout

{"include":"billing_address","order":**{"bill_address_attributes":{"id":1}}**}

As can be seen other user's address is displayed.

Impact

As a result, an attacker can:

  • Replace the address identifier with one belonging to another user
  • Cause the backend to associate and return another user’s address within the attacker’s order
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "4.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "5.1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.0"
            },
            {
              "fixed": "5.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22588"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-08T21:27:03Z",
    "nvd_published_at": "2026-01-08T21:15:44Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users\u2019 address information by modifying an existing order.\nBy editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker\u2019s order and returning them in the response.\n\n### Details\nAffected Component(s)\n- Authenticated user order management\n- Address association logic\n- Order update endpoint(s)\nAffected Endpoint(s):\n- `/api/v2/storefront/checkout`\n\nThe application fails to enforce proper object-level authorization when updating an existing order. While the user is authenticated and authorized to modify their own order, the backend does not verify that the supplied address identifiers belong to the same authenticated user.\n\n### PoC\nPreconditions\n- Valid authenticated user account\n\nStep 1: Log-in using a valid user, in this case customer2@example.com\nStep 2: Visualize current user\u2019s addresses \n\n**Request**\nGET `/account/addresses`\n\nThe following screenshot shows customer2@example.com address. \n\n\u003cimg width=\"336\" height=\"375\" alt=\"User Address\" src=\"https://github.com/user-attachments/assets/ceb1f214-7ac0-40b0-af22-6fe9d21254bb\" /\u003e\n\nStep 3: Initialize the Shopping Cart\n\n**Request**\nPOST `/api/v2/storefront/cart HTTP/1.1`\n\nFrom the response, extract the token marked in bold.\n\nStep 4: Legitimate Order Edit Request\n\nUsing the obtained order token **A1cram_6cFWpoj4V1yPkuQ1767113871701** perform an edit order  request in order to add a custom billing address\n\n**Request**\nPATCH `/api/v2/storefront/checkout`\n\n```json\n{\n    \"include\": \"billing_address\",\n    \"order\": {\n      \"email\": \"idor_test@example.com\",\n      \"bill_address_attributes\": {\n        \"firstname\":\"CTF\",\"lastname\":\"Tester\",\"address1\":\"123 Main St\",\n        \"city\":\"Andorra la Vella\",\"zipcode\":\"AD100\",\"country_iso\":\"AD\"\n      },\n      \"ship_address_attributes\": {\n        \"firstname\":\"CTF\",\"lastname\":\"Tester\",\"address1\":\"123 Main St\",\n        \"city\":\"Andorra la Vella\",\"zipcode\":\"AD100\",\"country_iso\":\"AD\"\n      }\n    }\n  }\n```\n\nStep 5: Modify the order request to include the other user\u0027s address and trigger the IDOR.\n\nIn this request, the attacker modifies the request by substituting the address identifier with one belonging to another user, thereby rendering the original address identifier accessible to the attacker.\n\n**Request**\nPATCH `/api/v2/storefront/checkout`\n\n```json\n{\"include\":\"billing_address\",\"order\":**{\"bill_address_attributes\":{\"id\":1}}**}\n```\n\nAs can be seen other user\u0027s address is displayed.\n\n### Impact\nAs a result, an attacker can:\n\n- Replace the address identifier with one belonging to another user\n- Cause the backend to associate and return another user\u2019s address within the attacker\u2019s order",
  "id": "GHSA-g268-72p7-9j6j",
  "modified": "2026-01-11T14:57:07Z",
  "published": "2026-01-08T21:27:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/security/advisories/GHSA-g268-72p7-9j6j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22588"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/17e78a91b736b49dbea8d1bb1223c284383ee5f3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/b409c0fd327e7ce37f63238894670d07079eefe8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/d3f961c442e0015661535cbd6eb22475f76d2dc7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_api/CVE-2026-22588.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spree/spree"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification"
}

GHSA-G288-P356-RJ5F

Vulnerability from github – Published: 2025-04-15 09:30 – Updated: 2025-04-15 09:30
VLAI
Details

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint.

Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-3575"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-15T09:15:13Z",
    "severity": "HIGH"
  },
  "details": "Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via \"idUsuario\" parameter in \"/helper/Familia/establecerUsuarioSeleccion\" endpoint.",
  "id": "GHSA-g288-p356-rj5f",
  "modified": "2025-04-15T09:30:34Z",
  "published": "2025-04-15T09:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3575"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-deporsite-t-innova"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-G34J-Q536-5J2M

Vulnerability from github – Published: 2026-01-29 15:30 – Updated: 2026-01-29 15:30
VLAI
Details

EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-37008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-29T15:16:07Z",
    "severity": "HIGH"
  },
  "details": "EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.",
  "id": "GHSA-g34j-q536-5j2m",
  "modified": "2026-01-29T15:30:28Z",
  "published": "2026-01-29T15:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37008"
    },
    {
      "type": "WEB",
      "url": "https://www.elektraweb.com/en"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/48858"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/easypms-authentication-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list