CWE-639

{
  "affected": [],
  "aliases": [
    "CVE-2023-6504"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-11T09:15:48Z",
    "severity": "MODERATE"
  },
  "details": "The User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles \u0026 User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.",
  "id": "GHSA-j7h7-7c79-56qf",
  "modified": "2026-04-08T21:32:10Z",
  "published": "2024-01-11T09:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6504"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3012472/profile-builder"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f515ccf8-7231-4728-b155-c47049087d42?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-1947"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-16T14:18:08Z",
    "severity": "HIGH"
  },
  "details": "The NEX-Forms \u2013 Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.9 via the submit_nex_form() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to to overwrite arbitrary form entries via the \u0027nf_set_entry_update_id\u0027 parameter.",
  "id": "GHSA-j7pc-x3vr-q64w",
  "modified": "2026-03-16T15:30:42Z",
  "published": "2026-03-16T15:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1947"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3470888/nex-forms-express-wp-form-builder"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a8c307-2430-4ea9-afe0-e5e758eabdd1?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-1541"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-15T04:17:33Z",
    "severity": "MODERATE"
  },
  "details": "The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin\u0027s `fusion_get_post_custom_field()` function failing to validate whether metadata keys are protected (underscore-prefixed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract protected post metadata fields that should not be publicly accessible via the Dynamic Data feature\u0027s `post_custom_field` parameter.",
  "id": "GHSA-j7wx-2ff4-pc88",
  "modified": "2026-04-22T21:31:43Z",
  "published": "2026-04-22T21:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1541"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f1f69f93-80e3-434d-98a6-fc8757b4e6d1?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-9938"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-03-22T08:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The SHAREit application before 4.0.42 for Android allows a remote attacker (on the same network or joining public \"open\" Wi-Fi hotspots created by the application when file transfer is initiated) to download arbitrary files from the device including contacts, photos, videos, sound clips, etc. The attacker must be authenticated as a \"recognized device.\"",
  "id": "GHSA-j82h-gmgf-2c58",
  "modified": "2022-05-13T01:08:22Z",
  "published": "2022-05-13T01:08:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9938"
    },
    {
      "type": "WEB",
      "url": "https://blog.redforce.io/shareit-vulnerabilities-enable-unrestricted-access-to-adjacent-devices-files"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-0732"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-24T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.",
  "id": "GHSA-j85g-452w-9q39",
  "modified": "2022-03-17T00:05:15Z",
  "published": "2022-02-25T00:01:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0732"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/284.html"
    },
    {
      "type": "WEB",
      "url": "https://kb.cert.org/vuls/id/229438"
    },
    {
      "type": "WEB",
      "url": "https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/229438"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-4036"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-30T15:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected ones",
  "id": "GHSA-j874-rmjf-2w72",
  "modified": "2024-04-04T07:17:35Z",
  "published": "2023-08-30T15:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4036"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/de3e1718-c358-4510-b142-32896ffeb03f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@better-auth/scim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0"
            },
            {
              "fixed": "1.7.0-beta.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T20:57:05Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Am I affected?\n\nUsers are affected if all of these hold:\n\n- They install and register the `@better-auth/scim` plugin (`plugins: [scim()]`).\n- They create SCIM providers without an `organizationId`, that is, non-organization (\"personal\") providers. Organization-scoped providers are not affected because they enforce organization membership and role.\n- Their application\u0027s deployment has more than one authenticated user, so one account can target another user\u0027s provider.\n- They have not set `providerOwnership: { enabled: true }`.\n\nThe SCIM management endpoints first shipped in `1.5.0`, so every stable release from `1.5.0` onward is affected, and the stable line is not patched. On the pre-release line, builds through `1.7.0-beta.3` are affected, and `1.7.0-beta.4` carries the fix.\n\nFix:\n\n1. Upgrade to `@better-auth/scim@1.7.0-beta.4` (then `1.7.0`). This is a breaking change: it removes the `providerOwnership` option, makes owner binding mandatory, and adds a permanent `scimProvider.userId` column.\n2. Run the schema migration after upgrading (`npx auth migrate`). Connections created before the upgrade carry no owner and become unreachable through the management endpoints, so reclaim them at the database level.\n3. The `1.6.x` stable line is not patched. If developers stay on it, apply the workaround below.\n\n### Summary\n\n`@better-auth/scim` does not bind non-organization SCIM providers to their creator in the default configuration. Any authenticated user can manage another user\u0027s non-org provider, including reading its metadata, listing connections, regenerating its SCIM bearer token, and deleting the connection. Regenerating the token rotates it: the legitimate token stops working and the attacker holds a valid one.\n\n### Details\n\nThe plugin tracks provider ownership through an opt-in `providerOwnership` option and a `scimProvider.userId` column. Both default to off. When ownership is disabled, a non-org provider row is created without a `userId`, and the management access check denies access only when a stored owner id is present and differs from the caller:\n\n```ts\n// non-organization branch of the access check\n} else if (provider.userId \u0026\u0026 provider.userId !== userId) {\n  throw new APIError(\"FORBIDDEN\", { message: \"You must be the owner to access this provider\" });\n}\n```\n\nBecause the default row has no `userId`, the condition is false and the request is allowed. The same gap reaches every management operation: token generation and regeneration, single-provider read, the connection list (which returns providers where `p.userId === userId || !p.userId`), and provider deletion.\n\nThe most sensitive operation is token regeneration. If Alice creates a non-org provider `corp-idp`, Bob can call the same generate-token endpoint with `providerId: \"corp-idp\"`. The existing row passes the ownerless access check, so the plugin deletes it, creates a fresh row, and returns a new SCIM bearer token to Bob. Alice\u0027s previous token is now invalid, and Bob\u0027s token authenticates against that provider\u0027s SCIM API routes.\n\nThis requires no organization membership and no elevated role. It is reachable in the default `scim()` configuration whenever non-organization providers are used.\n\n### Proof of concept\n\nTwo authenticated users, Alice and Bob, in a default `scim()` setup:\n\n1. Alice signs in and creates a non-org provider: `POST /scim/generate-token` with `{ \"providerId\": \"corp-idp\" }`.\n2. Bob signs in and reads Alice\u0027s provider: `GET /scim/get-provider-connection?providerId=corp-idp` returns `200` with `{ \"providerId\": \"corp-idp\" }`.\n3. Bob regenerates the token: `POST /scim/generate-token` with `{ \"providerId\": \"corp-idp\" }` returns `201` and a new `scimToken`.\n4. Alice\u0027s old token is rejected at `GET /scim/v2/Users` (`401`); Bob\u0027s regenerated token is accepted (`200`).\n\nThe behavior is reproducible through Better Auth\u0027s public API surface with two distinct sessions.\n\n### Patches\n\nFixed in `@better-auth/scim@1.7.0-beta.4` (then `1.7.0`). The fix makes owner binding mandatory: `generateSCIMToken` records the creator\u0027s `userId` on every personal connection, and the management endpoints grant access only to that owner. Organization-scoped connections keep their existing membership and role checks. The `1.6.x` stable line is not patched.\n\nThis release is breaking. It removes the `providerOwnership` option, owner binding can no longer be disabled, and the `scimProvider.userId` column becomes a permanent part of the schema, so run `npx auth migrate` after upgrading. Connections created before the upgrade carry no owner and fail closed; reclaim them by deleting `scimProvider` rows that have neither `organizationId` nor `userId`, or by setting `userId` to the intended owner, then regenerating tokens.\n\n### Workarounds\n\nUntil a patched version is available:\n\n- Set `providerOwnership: { enabled: true }` when registering the plugin, then run the schema update so the `scimProvider.userId` column exists (`npx auth generate` or `npx auth migrate`). New non-org providers are then owner-bound and non-owners are denied. Providers created before enabling ownership stay ownerless until recreated.\n- Or scope every SCIM provider to an organization by always passing `organizationId`. Organization providers enforce membership and role and are not exposed.\n- Or restrict access to the SCIM management endpoints at the edge while non-org providers remain ownerless.\n\n### Impact\n\nAny authenticated user can take over non-organization SCIM providers created by other users when the plugin runs with its default ownership configuration. An attacker can discover non-org provider connections, read provider metadata, regenerate another user\u0027s SCIM token (invalidating the legitimate one), authenticate to the SCIM API routes with the new token, manage SCIM-provisioned users subject to the enabled SCIM functionality, and delete the provider connection.\n\n### Credit\n\nReported by Jvr2022 through a private GitHub Security Advisory.\n\n### Resources\n\n- CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html\n- CWE-639 Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html\n- SCIM 2.0 Protocol (RFC 7644): https://datatracker.ietf.org/doc/html/rfc7644\n- OAuth 2.0 Bearer Token Usage (RFC 6750): https://datatracker.ietf.org/doc/html/rfc6750",
  "id": "GHSA-j8v8-g9cx-5qf4",
  "modified": "2026-07-07T20:57:06Z",
  "published": "2026-07-07T20:57:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/better-auth/better-auth"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-4226"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-15T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented.",
  "id": "GHSA-j8wj-77mv-262g",
  "modified": "2022-12-20T18:30:20Z",
  "published": "2022-12-15T21:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4226"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/c0ed80c8-ebbf-4ed9-b02f-31660097c352"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-27938"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-15T21:15:55Z",
    "severity": "MODERATE"
  },
  "details": "Unauthenticated attackers can obtain restricted information about a user\u0027s smart device collections (i.e., \"rooms\").",
  "id": "GHSA-j9qf-mqgv-w6rw",
  "modified": "2025-04-15T21:31:45Z",
  "published": "2025-04-15T21:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27938"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-11247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-11T05:16:35Z",
    "severity": "MODERATE"
  },
  "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries.",
  "id": "GHSA-j9w8-4m8f-75m4",
  "modified": "2025-12-11T06:30:24Z",
  "published": "2025-12-11T06:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11247"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3307422"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/573766"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}