Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3290 vulnerabilities reference this CWE, most recent first.
GHSA-H3M5-97JQ-QJRF
Vulnerability from github – Published: 2026-06-19 21:43 – Updated: 2026-07-02 20:12
VLAI
Summary
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
Details
Summary
OpenRemote Manager is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) in the bulk alarm deletion endpoint. An authenticated user in any realm can delete alarms belonging to other realms (tenants) by supplying arbitrary alarm IDs. The vulnerability exists because the bulk removeAlarms() method only verifies that the caller's own realm is active and accessible, but never checks whether the targeted alarm IDs belong to the caller's realm before deleting them.
This allows any user with alarm write permissions in their own realm to permanently destroy alarm records — including safety-critical and security alerts — belonging to any other tenant on the same OpenRemote installation.
[Additional Information] The singular removeAlarm() method correctly validates that the target alarm's realm matches the caller's access:
// CORRECT (singular):
SentAlarm alarm = alarmService.getAlarm(alarmId);
if (!isRealmActiveAndAccessible(alarm.getRealm())) {
throw new ForbiddenException(...);
}
The plural removeAlarms() method is missing this per-alarm realm check and only validates the caller's own realm — a check that is trivially satisfied for any authenticated user:
// VULNERABLE (plural):
public void removeAlarms(RequestParams requestParams, List<Long> alarmIds) {
if (!isRealmActiveAndAccessible(getAuthenticatedRealmName())) {
throw new ForbiddenException(...); // always passes for any auth user
}
List<SentAlarm> alarms = alarmService.getAlarms(alarmIds); // no realm filter
alarmService.removeAlarms(alarms, alarmIds); // no realm filter
}
The underlying service queries contain no realm scoping:
``` // AlarmService.getAlarms(List): "select sa from SentAlarm sa where sa.id in :ids" // no realm filter
// AlarmService.removeAlarms():
"delete from SentAlarm sa where sa.id in :ids"
// no realm filter
Alarm IDs are sequential auto-increment Long values (JPA
@GeneratedValue), making them trivially enumerable.
[Vulnerability Type]
Insecure Direct Object Reference (IDOR) / Missing Authorization
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862: Missing Authorization
------------------------------------------
[Vendor of Product]
OpenRemote Inc. (openremote.io)
------------------------------------------
[Affected Product Code Base]
OpenRemote Manager - current version as of 2026
(github.com/openremote/openremote)
------------------------------------------
[Affected Component]
org.openremote.manager.alarm.AlarmResourceImpl#removeAlarms()
org.openremote.manager.alarm.AlarmService#getAlarms(List<Long>)
org.openremote.manager.alarm.AlarmService#removeAlarms()
File: manager/src/main/java/org/openremote/manager/alarm/AlarmResourceImpl.java
File: manager/src/main/java/org/openremote/manager/alarm/AlarmService.java
------------------------------------------
[Attack Type]
Remote (authenticated)
------------------------------------------
[CVE Impact Other]
Cross-tenant permanent destruction of alarm records, including
safety-critical and security alerts in IoT environments. Also enables
cross-tenant alarm enumeration (presence disclosure of alarm IDs
across all tenants).
------------------------------------------
[Attack Vectors]
1. Attacker registers or obtains any low-privilege account in any realm
on the target OpenRemote installation (or uses an existing account).
2. Attacker enumerates alarm IDs belonging to other realms by sending
bulk delete requests with sequential IDs (presence confirmed by
404 vs 200 response codes).
3. Attacker issues a single bulk delete request containing IDs of
alarms belonging to victim realm(s).
4. Alarms are permanently deleted with no authorization error.
PoC:
Tenant A (attacker) : realm = "tenant-a" user = attacker@tenant-a.com role = WRITE_ALARMS_ROLE
Tenant B (victim) : realm = "tenant-b" alarms with IDs 1174,1173, 1180 exist
DELETE /api/smartcity/alarm HTTP/2 Content-Type: application/json
[1174,1173, 1180] /// <- alarm ID ```
Severity
9.6 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.openremote:openremote-manager"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-57168"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T21:43:17Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary\nOpenRemote Manager is vulnerable to a cross-tenant Insecure Direct\nObject Reference (IDOR) in the bulk alarm deletion endpoint. An\nauthenticated user in any realm can delete alarms belonging to other\nrealms (tenants) by supplying arbitrary alarm IDs. The vulnerability\nexists because the bulk removeAlarms() method only verifies that the\ncaller\u0027s own realm is active and accessible, but never checks whether\nthe targeted alarm IDs belong to the caller\u0027s realm before deleting\nthem.\n\nThis allows any user with alarm write permissions in their own realm\nto permanently destroy alarm records \u2014 including safety-critical and\nsecurity alerts \u2014 belonging to any other tenant on the same OpenRemote\ninstallation.\n\n------------------------------------------\n\n[Additional Information]\nThe singular removeAlarm() method correctly validates that the\ntarget alarm\u0027s realm matches the caller\u0027s access:\n\n // CORRECT (singular):\n SentAlarm alarm = alarmService.getAlarm(alarmId);\n if (!isRealmActiveAndAccessible(alarm.getRealm())) {\n throw new ForbiddenException(...);\n }\n\nThe plural removeAlarms() method is missing this per-alarm realm\ncheck and only validates the caller\u0027s own realm \u2014 a check that is\ntrivially satisfied for any authenticated user:\n\n```\n // VULNERABLE (plural):\npublic void removeAlarms(RequestParams requestParams, List\u003cLong\u003e alarmIds) {\n if (!isRealmActiveAndAccessible(getAuthenticatedRealmName())) { \n throw new ForbiddenException(...); // always passes for any auth user\n }\n List\u003cSentAlarm\u003e alarms = alarmService.getAlarms(alarmIds); // no realm filter\n alarmService.removeAlarms(alarms, alarmIds); // no realm filter\n}\n\n```\nThe underlying service queries contain no realm scoping:\n\n ```\n // AlarmService.getAlarms(List\u003cLong\u003e):\n \"select sa from SentAlarm sa where sa.id in :ids\"\n // no realm filter\n\n // AlarmService.removeAlarms():\n \"delete from SentAlarm sa where sa.id in :ids\"\n // no realm filter\n\n```\nAlarm IDs are sequential auto-increment Long values (JPA\n@GeneratedValue), making them trivially enumerable.\n\n[Vulnerability Type]\nInsecure Direct Object Reference (IDOR) / Missing Authorization\nCWE-639: Authorization Bypass Through User-Controlled Key\nCWE-862: Missing Authorization\n\n------------------------------------------\n\n[Vendor of Product]\nOpenRemote Inc. (openremote.io)\n\n------------------------------------------\n\n[Affected Product Code Base]\nOpenRemote Manager - current version as of 2026\n(github.com/openremote/openremote)\n\n------------------------------------------\n\n[Affected Component]\norg.openremote.manager.alarm.AlarmResourceImpl#removeAlarms()\norg.openremote.manager.alarm.AlarmService#getAlarms(List\u003cLong\u003e)\norg.openremote.manager.alarm.AlarmService#removeAlarms()\n\nFile: manager/src/main/java/org/openremote/manager/alarm/AlarmResourceImpl.java\nFile: manager/src/main/java/org/openremote/manager/alarm/AlarmService.java\n\n------------------------------------------\n\n[Attack Type]\nRemote (authenticated)\n\n------------------------------------------\n\n[CVE Impact Other]\nCross-tenant permanent destruction of alarm records, including\nsafety-critical and security alerts in IoT environments. Also enables\ncross-tenant alarm enumeration (presence disclosure of alarm IDs\nacross all tenants).\n\n------------------------------------------\n\n[Attack Vectors]\n1. Attacker registers or obtains any low-privilege account in any realm\n on the target OpenRemote installation (or uses an existing account).\n2. Attacker enumerates alarm IDs belonging to other realms by sending\n bulk delete requests with sequential IDs (presence confirmed by\n 404 vs 200 response codes).\n3. Attacker issues a single bulk delete request containing IDs of\n alarms belonging to victim realm(s).\n4. Alarms are permanently deleted with no authorization error.\n\nPoC:\n\n```\nTenant A (attacker) : realm = \"tenant-a\"\n user = attacker@tenant-a.com\n role = WRITE_ALARMS_ROLE\n\nTenant B (victim) : realm = \"tenant-b\"\n alarms with IDs 1174,1173, 1180 exist\n```\n\n\n\n```\nDELETE /api/smartcity/alarm HTTP/2\nContent-Type: application/json\n\n\n[1174,1173, 1180] /// \u003c- alarm ID \n```\n\n\u003cimg width=\"1280\" height=\"404\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ffbebea2-2248-42a0-bb22-7a0dc51c78ce\" /\u003e",
"id": "GHSA-h3m5-97jq-qjrf",
"modified": "2026-07-02T20:12:17Z",
"published": "2026-06-19T21:43:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf"
},
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/commit/9fad55e5a448c82772d241d395826e5d6fe1ce2d"
},
{
"type": "PACKAGE",
"url": "https://github.com/openremote/openremote"
},
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/blob/master/manager/src/main/java/org/openremote/manager/alarm/AlarmResourceImpl.java"
},
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/blob/master/manager/src/main/java/org/openremote/manager/alarm/AlarmService.java"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)"
}
GHSA-H3P7-VXPM-G349
Vulnerability from github – Published: 2024-06-14 18:31 – Updated: 2024-11-19 00:32
VLAI
Details
An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. This vulnerability can allow attackers to access the router via a brute-force attack.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-33373"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-14T16:15:11Z",
"severity": "MODERATE"
},
"details": "An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. This vulnerability can allow attackers to access the router via a brute-force attack.",
"id": "GHSA-h3p7-vxpm-g349",
"modified": "2024-11-19T00:32:42Z",
"published": "2024-06-14T18:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33373"
},
{
"type": "WEB",
"url": "https://github.com/ShravanSinghRathore/Security-Advisory-Multiple-Vulnerabilities-in-LB-link-BL-W1210M-Router/wiki/Password-Policy-Bypass--%7C--Inconsistent-Password-Policy-%28CVE%E2%80%902024%E2%80%9033373%29"
},
{
"type": "WEB",
"url": "https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-lb-link-bl-w1210m-router"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-H3VP-QWMX-5J25
Vulnerability from github – Published: 2025-05-02 21:30 – Updated: 2025-05-05 19:57
VLAI
Summary
Grokability Snipe-IT has incorrect authorization for accessing asset information
Details
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
Severity
5.0 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-47226"
],
"database_specific": {
"cwe_ids": [
"CWE-425",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-05T19:57:22Z",
"nvd_published_at": "2025-05-02T21:15:23Z",
"severity": "MODERATE"
},
"details": "Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.",
"id": "GHSA-h3vp-qwmx-5j25",
"modified": "2025-05-05T19:57:22Z",
"published": "2025-05-02T21:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47226"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/pull/16672"
},
{
"type": "PACKAGE",
"url": "https://github.com/grokability/snipe-it"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/compare/v8.0.4...v8.1.0"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/releases/tag/v8.1.0"
},
{
"type": "WEB",
"url": "https://github.com/koyomihack00/CVE-2025-47226/blob/main/PoC/idor-exploit.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Grokability Snipe-IT has incorrect authorization for accessing asset information"
}
GHSA-H42Q-JJCQ-2FF4
Vulnerability from github – Published: 2022-04-15 00:00 – Updated: 2022-04-22 00:00
VLAI
Details
An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the Paragon Active Assurance Control Center which allows users to selective share account data using a unique identifier. Knowing the proper format of the URL and the identifier of an existing object in an application it is possible to get access to that object without being logged in, even if the object is not shared, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance version 3.1.0.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-22190"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-14T16:15:00Z",
"severity": "HIGH"
},
"details": "An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the Paragon Active Assurance Control Center which allows users to selective share account data using a unique identifier. Knowing the proper format of the URL and the identifier of an existing object in an application it is possible to get access to that object without being logged in, even if the object is not shared, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance version 3.1.0.",
"id": "GHSA-h42q-jjcq-2ff4",
"modified": "2022-04-22T00:00:55Z",
"published": "2022-04-15T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22190"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/JSA69500"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H44W-W4W4-CJC2
Vulnerability from github – Published: 2025-01-17 06:30 – Updated: 2025-02-20 21:30
VLAI
Details
TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information. This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-11146"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-17T06:15:15Z",
"severity": "LOW"
},
"details": "TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information. This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.",
"id": "GHSA-h44w-w4w4-cjc2",
"modified": "2025-02-20T21:30:50Z",
"published": "2025-01-17T06:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11146"
},
{
"type": "WEB",
"url": "https://infosec.exchange/@abreacher"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-25-016-01.json"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-25-017-01.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:L/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-H4JX-296R-RQCC
Vulnerability from github – Published: 2025-09-30 12:30 – Updated: 2025-10-08 18:30
VLAI
Details
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a misuse of the general enquiry web service.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-41098"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-30T11:37:40Z",
"severity": "HIGH"
},
"details": "Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a\u00a0 misuse of the general enquiry web service.",
"id": "GHSA-h4jx-296r-rqcc",
"modified": "2025-10-08T18:30:15Z",
"published": "2025-09-30T12:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41098"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-H4P3-CG85-78C7
Vulnerability from github – Published: 2025-03-11 03:30 – Updated: 2025-03-11 03:30
VLAI
Details
The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application's integrity, with no effect on confidentiality and availability of the application.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-27433"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-11T01:15:36Z",
"severity": "MODERATE"
},
"details": "The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application\u0027s integrity, with no effect on confidentiality and availability of the application.",
"id": "GHSA-h4p3-cg85-78c7",
"modified": "2025-03-11T03:30:51Z",
"published": "2025-03-11T03:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27433"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3565835"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H564-6GC2-FCC6
Vulnerability from github – Published: 2022-05-24 17:21 – Updated: 2025-12-05 15:11
VLAI
Summary
Mattermost Server allows users with a session ID to revoke another users' session
Details
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.2-0.20171004201910-6be8113eb60c"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0-rc1"
},
{
"fixed": "4.2.1-0.20171004192657-8fbbd688ea24"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.0-rc1"
},
{
"fixed": "4.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-18878"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639",
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-05T15:11:20Z",
"nvd_published_at": "2020-06-19T19:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user\u0027s session.",
"id": "GHSA-h564-6gc2-fcc6",
"modified": "2025-12-05T15:11:21Z",
"published": "2022-05-24T17:21:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18878"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/6be8113eb60cf5ddd2dc1c3f4db05cae0c183086"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/8fbbd688ea2466dd0d70e9c07e9703d78f8a19a5"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/affd35071ea155069979fd359726296de8aa6aaf"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Mattermost Server allows users with a session ID to revoke another users\u0027 session"
}
GHSA-H58J-PPGW-M32V
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-10-26 12:00
VLAI
Details
The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allowing any authenticated users to delete arbitrary page/post and booking via an IDOR vector.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-24318"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-01T14:15:00Z",
"severity": "MODERATE"
},
"details": "The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allowing any authenticated users to delete arbitrary page/post and booking via an IDOR vector.",
"id": "GHSA-h58j-ppgw-m32v",
"modified": "2022-10-26T12:00:32Z",
"published": "2022-05-24T19:03:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24318"
},
{
"type": "WEB",
"url": "https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-639%5D-Listeo-WordPress-Theme-v1.6.10.txt"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/9afa7e11-68b3-4196-975e-8b3f8e68ce56"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H5C8-HMQH-2VV9
Vulnerability from github – Published: 2025-10-18 09:30 – Updated: 2025-10-18 09:30
VLAI
Details
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_quickview' AJAX endpoint due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-11741"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-18T07:15:36Z",
"severity": "MODERATE"
},
"details": "The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the \u0027woosq_quickview\u0027 AJAX endpoint due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to.",
"id": "GHSA-h5c8-hmqh-2vv9",
"modified": "2025-10-18T09:30:51Z",
"published": "2025-10-18T09:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11741"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3379189%40woo-smart-quick-view\u0026new=3379189%40woo-smart-quick-view\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/220487de-2a1c-47ec-ac65-db1af44aed3d?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.