CWE-639
Weakness AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system.
For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Relationships and members
Modes of introduction
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Retrieval of a user record occurs in the system based on some key value that is under user control. The key would typically identify a user-related record stored in the system and would be used to lookup that record for presentation to the user.
One manifestation of this weakness is when a system uses sequential or otherwise easily-guessable session IDs that would allow one user to easily switch to another user's session and read/modify their data.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Notes
Maintenance
As of CWE 4.20, the relationship between IDOR and BOLA needs to be investigated more closely, including research into how these terms are used in the industry. The CWE team suspects that IDOR can be a part of BOLA, but BOLA expands on the weakness inherent to IDOR in that it is not only about objects that are being directly referenced.
Content history
Suggested corrections to use of IDOR versus BOLA
updated Common_Consequences, Relationships, Type
updated Description
updated Relationships
updated Relationships
updated Common_Consequences
updated Relationships
updated Alternate_Terms, Applicable_Platforms, Description, Name, Potential_Mitigations, Relationships
updated Common_Consequences, Relationships
updated Relationships
updated Alternate_Terms, Common_Consequences
updated Relationships
updated Relationships
updated Description, Enabling_Factors_for_Exploitation, Modes_of_Introduction, Relationships
updated Relationships
updated Relationships
updated Relationships
updated Alternate_Terms
updated Relationships
updated Alternate_Terms
updated Relationships
updated Detection_Factors, Relationships
updated Mapping_Notes
updated Observed_Examples
updated Demonstrative_Examples
updated References, Relationships, Weakness_Ordinalities
updated Alternate_Terms, Maintenance_Notes, References
updated Description, Modes_of_Introduction, Time_of_Introduction
5738 vulnerabilities reference this CWE, most recent first.
GHSA-2M3F-82CC-H56X
Vulnerability from github – Published: 2025-04-22 09:30 – Updated: 2025-04-22 09:30An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file.
Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly.
{
"affected": [],
"aliases": [
"CVE-2025-3519"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-22T09:15:15Z",
"severity": "HIGH"
},
"details": "An authorization bypass\u00a0in\u00a0Unblu Spark allows a\u00a0participant of a conversation\u00a0to replace an existing, uploaded file.\n\nEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly.",
"id": "GHSA-2m3f-82cc-h56x",
"modified": "2025-04-22T09:30:35Z",
"published": "2025-04-22T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3519"
},
{
"type": "WEB",
"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2M9V-5Q2G-58VQ
Vulnerability from github – Published: 2026-07-21 20:29 – Updated: 2026-07-21 20:29Summary
A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object.
The issue appears to be caused by the source-object authorization check using broad repository accessibility instead of requiring Code-unit access to at least one repository that owns the requested LFS object.
Impact
This issue breaks the expected authorization boundary between repository units.
A user who does not have Code access to a private source repository should not be able to reuse or associate Git LFS objects owned by that repository. However, because the source-object accessibility check accepts broad repository access, non-Code access such as Issues access may be sufficient for the LFS object to be treated as accessible.
If the reused object becomes downloadable through the attacker-controlled target repository after metadata association, this can result in cross-repository Git LFS content disclosure.
The target repository write authorization is still enforced. The problem is specifically in the authorization decision for whether the source LFS object is accessible and may be reused.
Preconditions
The attacker needs:
- an authenticated Gitea account;
- Code write access to a target repository;
- non-Code access, such as Issues access, to a private source repository;
- knowledge of an existing Git LFS object OID and size from the private source repository.
Affected Area
The issue affects the Git LFS upload/object reuse path.
Relevant paths:
services/lfs/server.go
Relevant handlers:
BatchHandler
UploadHandler
Both paths can call:
git_model.LFSObjectAccessible(ctx, ctx.Doer, p.Oid)
The helper is located in:
models/git/lfs.go
The authorization check uses:
repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)
When unit.TypeInvalid is used, the repository access condition can include broad repository access, such as organization team membership through team_repo and team_user, without requiring that the user has access to the Code unit of the source repository.
By contrast, Code-specific repository access checks use a concrete unit type and include team_unit validation.
Validation
I reproduced this locally using Gitea's Go test harness.
Validated against commit:
dac41a124fd34820a3c8caf3b3592ba62cd514ff
The PoC creates the following scenario:
- The attacker has Code write access to the target repository.
- The source repository is private.
- The attacker does not have Code access to the source repository.
- The attacker only has Issues access to the source repository through an organization team.
- An LFS object exists in the source repository.
LFSObjectAccessible(ctx, attacker, oid)returnstrue.NewLFSMetaObject(ctx, targetRepo.ID, pointer)successfully creates LFS metadata for the target repository.
Test result:
=== RUN TestLFSObjectAccessibleAllowsNonCodeSourceAccess
--- PASS: TestLFSObjectAccessibleAllowsNonCodeSourceAccess
PASS
ok gitea.dev/models/git
No live instance was tested. Validation was performed only against a local test database.
Security Expectation
A user should not be allowed to reuse or associate an LFS object from a private source repository unless they have Code access to that source repository, or another permission level explicitly intended to grant access to repository file contents.
Non-Code permissions such as Issues access should not authorize access to Git LFS object content or allow Git LFS object reuse.
Suggested Fix
LFSObjectAccessible should require Code-unit access to at least one repository that owns the requested LFS object.
The check should avoid using unit.TypeInvalid for this source-object authorization decision. A Code-specific repository access condition should be used instead.
A regression test should cover:
- private source repository;
- user has Issues-only access to the source repository;
- user does not have Code access to the source repository;
- user has Code write access to the target repository;
- known LFS object exists in the source repository;
- object reuse must be rejected unless the user has Code access to the source repository.
Suggested Severity
Suggested severity: Medium to High.
The severity depends on whether the associated LFS object becomes downloadable through the target repository after reuse.
If the object becomes downloadable through the target repository, the issue should be considered High because it can lead to cross-repository Git LFS content disclosure.
Suggested CVSS v3.1 if content disclosure is confirmed:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Rationale:
- network reachable through Git LFS endpoints;
- requires authentication;
- requires knowledge of the LFS object OID and size;
- no user interaction required;
- breaks repository-level authorization expectations;
- primary impact is confidentiality of private Git LFS content;
- limited integrity impact through unauthorized LFS metadata association in the target repository.
Evidence
I can provide the local regression test and passing test log privately if needed.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "gitea.dev"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-28740"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-21T20:29:43Z",
"nvd_published_at": "2026-07-03T21:16:59Z",
"severity": "HIGH"
},
"details": "## Summary\n\nA user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object.\n\nThe issue appears to be caused by the source-object authorization check using broad repository accessibility instead of requiring Code-unit access to at least one repository that owns the requested LFS object.\n\n## Impact\n\nThis issue breaks the expected authorization boundary between repository units.\n\nA user who does not have Code access to a private source repository should not be able to reuse or associate Git LFS objects owned by that repository. However, because the source-object accessibility check accepts broad repository access, non-Code access such as Issues access may be sufficient for the LFS object to be treated as accessible.\n\nIf the reused object becomes downloadable through the attacker-controlled target repository after metadata association, this can result in cross-repository Git LFS content disclosure.\n\nThe target repository write authorization is still enforced. The problem is specifically in the authorization decision for whether the source LFS object is accessible and may be reused.\n\n## Preconditions\n\nThe attacker needs:\n\n* an authenticated Gitea account;\n* Code write access to a target repository;\n* non-Code access, such as Issues access, to a private source repository;\n* knowledge of an existing Git LFS object OID and size from the private source repository.\n\n## Affected Area\n\nThe issue affects the Git LFS upload/object reuse path.\n\nRelevant paths:\n\n```text\nservices/lfs/server.go\n```\n\nRelevant handlers:\n\n```text\nBatchHandler\nUploadHandler\n```\n\nBoth paths can call:\n\n```go\ngit_model.LFSObjectAccessible(ctx, ctx.Doer, p.Oid)\n```\n\nThe helper is located in:\n\n```text\nmodels/git/lfs.go\n```\n\nThe authorization check uses:\n\n```go\nrepo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)\n```\n\nWhen `unit.TypeInvalid` is used, the repository access condition can include broad repository access, such as organization team membership through `team_repo` and `team_user`, without requiring that the user has access to the Code unit of the source repository.\n\nBy contrast, Code-specific repository access checks use a concrete unit type and include `team_unit` validation.\n\n## Validation\n\nI reproduced this locally using Gitea\u0027s Go test harness.\n\nValidated against commit:\n\n```text\ndac41a124fd34820a3c8caf3b3592ba62cd514ff\n```\n\nThe PoC creates the following scenario:\n\n1. The attacker has Code write access to the target repository.\n2. The source repository is private.\n3. The attacker does not have Code access to the source repository.\n4. The attacker only has Issues access to the source repository through an organization team.\n5. An LFS object exists in the source repository.\n6. `LFSObjectAccessible(ctx, attacker, oid)` returns `true`.\n7. `NewLFSMetaObject(ctx, targetRepo.ID, pointer)` successfully creates LFS metadata for the target repository.\n\nTest result:\n\n```text\n=== RUN TestLFSObjectAccessibleAllowsNonCodeSourceAccess\n--- PASS: TestLFSObjectAccessibleAllowsNonCodeSourceAccess\nPASS\nok \tgitea.dev/models/git\n```\n\nNo live instance was tested. Validation was performed only against a local test database.\n\n## Security Expectation\n\nA user should not be allowed to reuse or associate an LFS object from a private source repository unless they have Code access to that source repository, or another permission level explicitly intended to grant access to repository file contents.\n\nNon-Code permissions such as Issues access should not authorize access to Git LFS object content or allow Git LFS object reuse.\n\n## Suggested Fix\n\n`LFSObjectAccessible` should require Code-unit access to at least one repository that owns the requested LFS object.\n\nThe check should avoid using `unit.TypeInvalid` for this source-object authorization decision. A Code-specific repository access condition should be used instead.\n\nA regression test should cover:\n\n* private source repository;\n* user has Issues-only access to the source repository;\n* user does not have Code access to the source repository;\n* user has Code write access to the target repository;\n* known LFS object exists in the source repository;\n* object reuse must be rejected unless the user has Code access to the source repository.\n\n## Suggested Severity\n\nSuggested severity: Medium to High.\n\nThe severity depends on whether the associated LFS object becomes downloadable through the target repository after reuse.\n\nIf the object becomes downloadable through the target repository, the issue should be considered High because it can lead to cross-repository Git LFS content disclosure.\n\nSuggested CVSS v3.1 if content disclosure is confirmed:\n\n```text\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N\n```\n\nRationale:\n\n* network reachable through Git LFS endpoints;\n* requires authentication;\n* requires knowledge of the LFS object OID and size;\n* no user interaction required;\n* breaks repository-level authorization expectations;\n* primary impact is confidentiality of private Git LFS content;\n* limited integrity impact through unauthorized LFS metadata association in the target repository.\n\n## Evidence\n\nI can provide the local regression test and passing test log privately if needed.",
"id": "GHSA-2m9v-5q2g-58vq",
"modified": "2026-07-21T20:29:43Z",
"published": "2026-07-21T20:29:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-2m9v-5q2g-58vq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28740"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/pull/38050"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/commit/1c7b7ea72df7cf81e88b8e09049608254d32e56e"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/commit/7b4a1a1a118501b9d0260301dfed7f52dfc36ee9"
},
{
"type": "WEB",
"url": "https://blog.gitea.com/release-of-1.26.3-and-1.26.4"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-gitea/gitea"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Gitea: Git LFS object reuse allows non-Code access to authorize private source objects"
}
GHSA-2MH5-3CW6-HRRQ
Vulnerability from github – Published: 2026-05-07 06:31 – Updated: 2026-06-11 14:48When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.cloud:spring-cloud-config-server"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"last_affected": "3.1.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.cloud:spring-cloud-config-server"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.0"
},
{
"last_affected": "4.1.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.cloud:spring-cloud-config-server"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"last_affected": "4.2.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.3.2"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.cloud:spring-cloud-config-server"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.0.2"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.cloud:spring-cloud-config-server"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40981"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-11T16:19:03Z",
"nvd_published_at": "2026-05-07T04:16:24Z",
"severity": "HIGH"
},
"details": "When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects.\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.",
"id": "GHSA-2mh5-3cw6-hrrq",
"modified": "2026-06-11T14:48:18Z",
"published": "2026-05-07T06:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40981"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-cloud/spring-cloud-config"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-40981"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Spring Cloud Config has an Authorization Bypass Through User-Controlled Key "
}
GHSA-2MVX-F5QM-V2CH
Vulnerability from github – Published: 2026-04-16 21:34 – Updated: 2026-04-16 21:34Summary
An unauthenticated Insecure Direct Object Reference (IDOR) and Denial of Service (DoS) vulnerability in the My Calendar plugin allows any unauthenticated user to extract calendar events (including private or hidden ones) from any sub-site on a WordPress Multisite network. On standard Single Site WordPress installations, this same endpoint crashes the PHP worker thread, creating an unauthenticated Denial of Service (DoS) vector.
Details
The vulnerability stems from the mc_ajax_mcjs_action AJAX function, which handles the mcjs_action endpoint. This endpoint is explicitly registered for unauthenticated users:
<?php
// In my-calendar-ajax.php
add_action( 'wp_ajax_nopriv_mcjs_action', 'mc_ajax_mcjs_action' );
When the behavior parameter is set to loadupcoming, the plugin accepts an args parameter from the $_REQUEST array. Instead of validating specific expected arguments, the plugin unsafely passes the entire string into PHP's parse_str() function:
<?php
$request = isset( $_REQUEST['args'] ) ? wp_unslash( sanitize_text_field( $_REQUEST['args'] ) ) : array();
$request = str_replace( '|', '&', $request );
$request = parse_str( $request, $args );
// ...
$response = my_calendar_upcoming_events( $args );
This allows an attacker to inject arbitrary key-value pairs into the $args array. This array is then passed to the my_calendar_upcoming_events() function located in my-calendar-widgets.php.
At the beginning of this function, the plugin processes the attacker-controlled site argument:
<?php
// In my-calendar-widgets.php
if ( $args['site'] ) {
$args['site'] = ( 'global' === $args['site'] ) ? BLOG_ID_CURRENT_SITE : $args['site'];
switch_to_blog( $args['site'] );
}
The plugin blindly passes the attacker's supplied site ID into WordPress core's switch_to_blog() function without checking if the requesting user has the appropriate network-level privileges (e.g., Super Admin).
On Multisite configurations, the database context switches to the targeted sub-site, queries its events, and returns the HTML-rendered events array in the JSON response, leading to Information Disclosure across tenant boundaries. On Single Site configurations, the switch_to_blog() function does not exist in WordPress core. Calling it triggers an Uncaught PHP Error (Call to undefined function switch_to_blog()), resulting in a 500 Internal Server error ("Critical Error"). Repeated requests to this unauthenticated endpoint easily exhaust server resources.
PoC
1. Multisite Information Disclosure - IDOR
curl -s "http://<target-domain>/wp-admin/admin-ajax.php?action=mcjs_action&behavior=loadupcoming&args=site=2"
2. Single Site Denial of Service (DoS)
If the WordPress instance is not a Multisite, passing any truthy value to the site parameter will instantly crash the request thread:
curl -i -s "http://<target-domain>/wp-admin/admin-ajax.php?action=mcjs_action&behavior=loadupcoming&args=site=1"
Impact
Vulnerability Type: Insecure Direct Object Reference (IDOR) / Information Exposure / Denial of Service (DoS) Who is impacted: All sites running the "My Calendar" plugin.
Anonymous internet users can silently map the network and extract private, unpublished, or intranet-specific events from unlaunched/internal sub-sites. Standard Single Site users are vulnerable to an easy-to-execute application-layer DoS, as it costs an attacker negligible resources to constantly crash PHP worker threads at an unauthenticated endpoint.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "joedolson/my-calendar"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40308"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T21:34:40Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nAn unauthenticated Insecure Direct Object Reference (IDOR) and Denial of Service (DoS) vulnerability in the My Calendar plugin allows any unauthenticated user to extract calendar events (including private or hidden ones) from any sub-site on a WordPress Multisite network. On standard Single Site WordPress installations, this same endpoint crashes the PHP worker thread, creating an unauthenticated Denial of Service (DoS) vector.\n\n### Details\n\nThe vulnerability stems from the `mc_ajax_mcjs_action AJAX` function, which handles the `mcjs_action` endpoint. This endpoint is explicitly registered for unauthenticated users:\n```php\n\u003c?php\n// In my-calendar-ajax.php\nadd_action( \u0027wp_ajax_nopriv_mcjs_action\u0027, \u0027mc_ajax_mcjs_action\u0027 );\n```\n\nWhen the behavior parameter is set to loadupcoming, the plugin accepts an args parameter from the $_REQUEST array. Instead of validating specific expected arguments, the plugin unsafely passes the entire string into PHP\u0027s parse_str() function:\n```php\n\u003c?php\n$request = isset( $_REQUEST[\u0027args\u0027] ) ? wp_unslash( sanitize_text_field( $_REQUEST[\u0027args\u0027] ) ) : array();\n$request = str_replace( \u0027|\u0027, \u0027\u0026\u0027, $request );\n$request = parse_str( $request, $args );\n// ...\n$response = my_calendar_upcoming_events( $args );\n```\n\nThis allows an attacker to inject arbitrary key-value pairs into the $args array. This array is then passed to the my_calendar_upcoming_events() function located in my-calendar-widgets.php.\n\nAt the beginning of this function, the plugin processes the attacker-controlled site argument:\n```php\n\u003c?php\n// In my-calendar-widgets.php\nif ( $args[\u0027site\u0027] ) {\n $args[\u0027site\u0027] = ( \u0027global\u0027 === $args[\u0027site\u0027] ) ? BLOG_ID_CURRENT_SITE : $args[\u0027site\u0027];\n switch_to_blog( $args[\u0027site\u0027] );\n}\n```\nThe plugin blindly passes the attacker\u0027s supplied site ID into WordPress core\u0027s `switch_to_blog()` function without checking if the requesting user has the appropriate network-level privileges (e.g., Super Admin).\n\nOn Multisite configurations, the database context switches to the targeted sub-site, queries its events, and returns the HTML-rendered events array in the JSON response, leading to Information Disclosure across tenant boundaries.\nOn Single Site configurations, the switch_to_blog() function does not exist in WordPress core. Calling it triggers an Uncaught PHP Error (Call to undefined function switch_to_blog()), resulting in a 500 Internal Server error (\"Critical Error\"). Repeated requests to this unauthenticated endpoint easily exhaust server resources.\n\n### PoC\n\n## 1. Multisite Information Disclosure - IDOR\n```\ncurl -s \"http://\u003ctarget-domain\u003e/wp-admin/admin-ajax.php?action=mcjs_action\u0026behavior=loadupcoming\u0026args=site=2\"\n```\n\n## 2. Single Site Denial of Service (DoS)\nIf the WordPress instance is not a Multisite, passing any truthy value to the site parameter will instantly crash the request thread:\n```\ncurl -i -s \"http://\u003ctarget-domain\u003e/wp-admin/admin-ajax.php?action=mcjs_action\u0026behavior=loadupcoming\u0026args=site=1\"\n```\n\n### Impact\n\n**Vulnerability Type**: Insecure Direct Object Reference (IDOR) / Information Exposure / Denial of Service (DoS)\n**Who is impacted**: All sites running the \"My Calendar\" plugin.\n\nAnonymous internet users can silently map the network and extract private, unpublished, or intranet-specific events from unlaunched/internal sub-sites.\nStandard Single Site users are vulnerable to an easy-to-execute application-layer DoS, as it costs an attacker negligible resources to constantly crash PHP worker threads at an unauthenticated endpoint.",
"id": "GHSA-2mvx-f5qm-v2ch",
"modified": "2026-04-16T21:34:40Z",
"published": "2026-04-16T21:34:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch"
},
{
"type": "PACKAGE",
"url": "https://github.com/joedolson/my-calendar"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar"
}
GHSA-2MXF-M4GH-HJ3G
Vulnerability from github – Published: 2026-08-28 21:31 – Updated: 2026-08-31 21:31Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users.
{
"affected": [],
"aliases": [
"CVE-2026-82280"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-28T20:20:19Z",
"severity": "HIGH"
},
"details": "Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users.",
"id": "GHSA-2mxf-m4gh-hj3g",
"modified": "2026-08-31T21:31:59Z",
"published": "2026-08-28T21:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82280"
},
{
"type": "WEB",
"url": "https://github.com/QuivrHQ/quivr/issues/3698"
},
{
"type": "WEB",
"url": "https://github.com/The-Vibe-Company/Quivr/issues/3698"
},
{
"type": "WEB",
"url": "https://github.com/QuivrHQ/quivr"
},
{
"type": "WEB",
"url": "https://github.com/QuivrHQ/quivr/blob/v0.0.322/backend/api/quivr_api/modules/prompt/controller/prompt_routes.py"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/quivr-prompt-endpoints-missing-ownership-validation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2P29-98C8-MC4X
Vulnerability from github – Published: 2022-11-29 21:30 – Updated: 2026-04-08 21:31The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets.
{
"affected": [],
"aliases": [
"CVE-2022-3995"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-29T21:15:00Z",
"severity": "MODERATE"
},
"details": "The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets.",
"id": "GHSA-2p29-98c8-mc4x",
"modified": "2026-04-08T21:31:45Z",
"published": "2022-11-29T21:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3995"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/2817824/woo-wallet/trunk?contextall=1\u0026old=2816610\u0026old_path=%2Fwoo-wallet%2Ftrunk"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec57e0b2-61b0-4b67-9784-dbb4e6c4e4a6?source=cve"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3995"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2P4Q-QCHF-H9Q6
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-06-08 15:32A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specific configurations.
{
"affected": [],
"aliases": [
"CVE-2026-3999"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:55:13Z",
"severity": "HIGH"
},
"details": "A broken access control may allow an authenticated user to perform a \nhorizontal privilege escalation. The vulnerability only impacts specific\n configurations.",
"id": "GHSA-2p4q-qchf-h9q6",
"modified": "2026-06-08T15:32:40Z",
"published": "2026-03-13T21:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3999"
},
{
"type": "WEB",
"url": "https://docs.pointsharp.com/psa/advisories/psa-2026-001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2P54-Q56G-9668
Vulnerability from github – Published: 2026-01-15 18:31 – Updated: 2026-01-15 18:31TestLink versions 1.16 through 1.19 contain an unauthenticated file download vulnerability in the attachmentdownload.php endpoint. Attackers can download arbitrary files by iterating file IDs through the 'id' parameter with 'skipCheck=1' to bypass access controls.
{
"affected": [],
"aliases": [
"CVE-2021-47760"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-15T16:16:06Z",
"severity": "MODERATE"
},
"details": "TestLink versions 1.16 through 1.19 contain an unauthenticated file download vulnerability in the attachmentdownload.php endpoint. Attackers can download arbitrary files by iterating file IDs through the \u0027id\u0027 parameter with \u0027skipCheck=1\u0027 to bypass access controls.",
"id": "GHSA-2p54-q56g-9668",
"modified": "2026-01-15T18:31:29Z",
"published": "2026-01-15T18:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47760"
},
{
"type": "WEB",
"url": "https://testlink.org"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20211208031345/https://nch.ninja/blog/unauthorized-file-download-attached-files-testlink-116-119"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/50578"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2P5W-5398-X2R9
Vulnerability from github – Published: 2026-09-04 12:31 – Updated: 2026-09-04 12:31OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim organization's guessable dashboardId to read confidential report definitions or permanently delete dashboard layouts across tenant boundaries.
{
"affected": [],
"aliases": [
"CVE-2026-85611"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T12:17:24Z",
"severity": "MODERATE"
},
"details": "OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller\u0027s project. Authenticated attackers can supply their own projectId with a victim organization\u0027s guessable dashboardId to read confidential report definitions or permanently delete dashboard layouts across tenant boundaries.",
"id": "GHSA-2p5w-5398-x2r9",
"modified": "2026-09-04T12:31:01Z",
"published": "2026-09-04T12:31:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-g3xf-pqfp-22v7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85611"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openpanel-before-2.3.0-cross-tenant-bola-via-report-procedures"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2P66-2G75-QW5G
Vulnerability from github – Published: 2024-04-09 21:32 – Updated: 2024-04-09 21:32The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts.
{
"affected": [],
"aliases": [
"CVE-2024-2543"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-09T19:15:35Z",
"severity": "MODERATE"
},
"details": "The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the \u0027get_uri_editor\u0027 function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts.",
"id": "GHSA-2p66-2g75-qw5g",
"modified": "2024-04-09T21:32:00Z",
"published": "2024-04-09T21:32:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2543"
},
{
"type": "WEB",
"url": "https://gist.github.com/Xib3rR4dAr/a248426dfee107c6fda08e80f98fa894"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3053899"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.