CWE-639
Weakness AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system.
For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Relationships and members
Modes of introduction
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Retrieval of a user record occurs in the system based on some key value that is under user control. The key would typically identify a user-related record stored in the system and would be used to lookup that record for presentation to the user.
One manifestation of this weakness is when a system uses sequential or otherwise easily-guessable session IDs that would allow one user to easily switch to another user's session and read/modify their data.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Notes
Maintenance
As of CWE 4.20, the relationship between IDOR and BOLA needs to be investigated more closely, including research into how these terms are used in the industry. The CWE team suspects that IDOR can be a part of BOLA, but BOLA expands on the weakness inherent to IDOR in that it is not only about objects that are being directly referenced.
Content history
Suggested corrections to use of IDOR versus BOLA
updated Common_Consequences, Relationships, Type
updated Description
updated Relationships
updated Relationships
updated Common_Consequences
updated Relationships
updated Alternate_Terms, Applicable_Platforms, Description, Name, Potential_Mitigations, Relationships
updated Common_Consequences, Relationships
updated Relationships
updated Alternate_Terms, Common_Consequences
updated Relationships
updated Relationships
updated Description, Enabling_Factors_for_Exploitation, Modes_of_Introduction, Relationships
updated Relationships
updated Relationships
updated Relationships
updated Alternate_Terms
updated Relationships
updated Alternate_Terms
updated Relationships
updated Detection_Factors, Relationships
updated Mapping_Notes
updated Observed_Examples
updated Demonstrative_Examples
updated References, Relationships, Weakness_Ordinalities
updated Alternate_Terms, Maintenance_Notes, References
updated Description, Modes_of_Introduction, Time_of_Introduction
5727 vulnerabilities reference this CWE, most recent first.
GHSA-2X59-2XMG-FGCX
Vulnerability from github – Published: 2022-09-08 00:00 – Updated: 2022-09-13 00:00WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children.
{
"affected": [],
"aliases": [
"CVE-2022-36539"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-07T17:15:00Z",
"severity": "HIGH"
},
"details": "WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children.",
"id": "GHSA-2x59-2xmg-fgcx",
"modified": "2022-09-13T00:00:35Z",
"published": "2022-09-08T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36539"
},
{
"type": "WEB",
"url": "https://apps.apple.com/nl/app/eigen-wijzer-ouderapp/id1331059326"
},
{
"type": "WEB",
"url": "https://github.com/Fopje/CVE-2022-36539"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2X8Q-M4R9-VG7H
Vulnerability from github – Published: 2026-10-30 15:34 – Updated: 2026-10-30 15:34ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
{
"affected": [],
"aliases": [
"CVE-2026-119661"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-30T15:16:50Z",
"severity": "LOW"
},
"details": "ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users\u0027 entry ids to permanently delete those parameter-description entries.",
"id": "GHSA-2x8q-m4r9-vg7h",
"modified": "2026-10-30T15:34:39Z",
"published": "2026-10-30T15:34:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119661"
},
{
"type": "WEB",
"url": "https://github.com/star7th/showdoc/issues/2612"
},
{
"type": "WEB",
"url": "https://github.com/star7th/showdoc/commit/53228511e656904abf7841c3d25ff78a4b5ce9c2"
},
{
"type": "WEB",
"url": "https://github.com/star7th/showdoc"
},
{
"type": "WEB",
"url": "https://github.com/star7th/showdoc/blob/v3.9.5/server/app/Api/Controller/ParamDescLibController.php#L545-L584"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/showdoc-paramdesclib-cross-item-idor-delete"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/showdoc-through-3.9.5-authorization-bypass-via-paramdesclib-deleteentries"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2XC6-348P-C2X6
Vulnerability from github – Published: 2026-03-11 00:12 – Updated: 2026-03-11 05:46Impact
An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via #[LiveArg] parameters. Unlike props, which are protected by LiveComponent's @checksum, args are fully user-controlled - any action that accepts a resource ID via #[LiveArg] and loads it with ->find() without ownership validation is vulnerable.
Checkout address FormComponent (addressFieldUpdated action): Accepts an addressId via #[LiveArg] and loads it without verifying ownership, exposing another user's first name, last name, company, phone number, street, city, postcode, and country.
Cart WidgetComponent (refreshCart action): Accepts a cartId via #[LiveArg] and loads any order directly from the repository, exposing order total and item count.
Cart SummaryComponent (refreshCart action): Accepts a cartId via #[LiveArg] and loads any order directly from the repository, exposing subtotal, discount, shipping cost, taxes (excluded and included), and order total.
Since sylius_order contains both active carts (state=cart) and completed orders (state=new/fulfilled) in the same ID space, the cart IDOR exposes data from all orders, not just active carts.
Patches
The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.
Workarounds
Override vulnerable LiveComponent classes at the project level to add authorization checks to #[LiveArg] parameters.
Step 1. Exclude component overrides from default autowiring
In config/services.yaml, add Twig/Component to the exclude list to prevent duplicate service registration:
App\:
resource: '../src/*'
exclude: '../src/{Entity,Kernel.php,Twig/Components}'
Step 2. Override checkout address FormComponent
Create src/Twig/Components/Checkout/Address/FormComponent.php:
<?php
declare(strict_types=1);
namespace App\Twig\Components\Checkout\Address;
use Sylius\Bundle\ShopBundle\Twig\Component\Checkout\Address\AddressBookComponent;
use Sylius\Bundle\UiBundle\Twig\Component\ResourceFormComponentTrait;
use Sylius\Bundle\UiBundle\Twig\Component\TemplatePropTrait;
use Sylius\Component\Core\Model\OrderInterface;
use Sylius\Component\Core\Model\ShopUserInterface;
use Sylius\Component\Core\Repository\AddressRepositoryInterface;
use Sylius\Component\Core\Repository\OrderRepositoryInterface;
use Sylius\Component\Customer\Context\CustomerContextInterface;
use Sylius\Component\User\Repository\UserRepositoryInterface;
use Symfony\Component\Form\FormFactoryInterface;
use Symfony\Component\Form\FormInterface;
use Symfony\UX\LiveComponent\Attribute\AsLiveComponent;
use Symfony\UX\LiveComponent\Attribute\LiveArg;
use Symfony\UX\LiveComponent\Attribute\LiveListener;
use Symfony\UX\LiveComponent\Attribute\LiveProp;
use Symfony\UX\LiveComponent\Attribute\PreReRender;
#[AsLiveComponent]
class FormComponent
{
/** @use ResourceFormComponentTrait<OrderInterface> */
use ResourceFormComponentTrait;
use TemplatePropTrait;
#[LiveProp]
public bool $emailExists = false;
/**
* @param OrderRepositoryInterface<OrderInterface> $repository
* @param UserRepositoryInterface<ShopUserInterface> $shopUserRepository
*/
public function __construct(
OrderRepositoryInterface $repository,
FormFactoryInterface $formFactory,
string $resourceClass,
string $formClass,
protected readonly CustomerContextInterface $customerContext,
protected readonly UserRepositoryInterface $shopUserRepository,
protected readonly AddressRepositoryInterface $addressRepository,
) {
$this->initialize($repository, $formFactory, $resourceClass, $formClass);
}
#[PreReRender(priority: -100)]
public function checkEmailExist(): void
{
$email = $this->formValues['customer']['email'] ?? null;
if (null !== $email) {
$this->emailExists = $this->shopUserRepository->findOneByEmail($email) !== null;
}
}
#[LiveListener(AddressBookComponent::SYLIUS_SHOP_ADDRESS_UPDATED)]
public function addressFieldUpdated(#[LiveArg] mixed $addressId, #[LiveArg] string $field): void
{
$customer = $this->customerContext->getCustomer();
if (null === $customer) {
return;
}
// Fix: findOneByCustomer instead of find — validates ownership
$address = $this->addressRepository->findOneByCustomer((string) $addressId, $customer);
if (null === $address) {
return;
}
$newAddress = [];
$newAddress['firstName'] = $address->getFirstName();
$newAddress['lastName'] = $address->getLastName();
$newAddress['phoneNumber'] = $address->getPhoneNumber();
$newAddress['company'] = $address->getCompany();
$newAddress['countryCode'] = $address->getCountryCode();
if ($address->getProvinceCode() !== null) {
$newAddress['provinceCode'] = $address->getProvinceCode();
}
if ($address->getProvinceName() !== null) {
$newAddress['provinceName'] = $address->getProvinceName();
}
$newAddress['street'] = $address->getStreet();
$newAddress['city'] = $address->getCity();
$newAddress['postcode'] = $address->getPostcode();
$this->formValues[$field] = $newAddress;
}
protected function instantiateForm(): FormInterface
{
return $this->formFactory->create(
$this->formClass,
$this->resource,
['customer' => $this->customerContext->getCustomer()],
);
}
}
Step 3. Override cart WidgetComponent
Create src/Twig/Components/Cart/WidgetComponent.php:
<?php
declare(strict_types=1);
namespace App\Twig\Components\Cart;
use Sylius\Bundle\ShopBundle\Twig\Component\Cart\FormComponent;
use Sylius\Bundle\UiBundle\Twig\Component\ResourceLivePropTrait;
use Sylius\Bundle\UiBundle\Twig\Component\TemplatePropTrait;
use Sylius\Component\Core\Model\OrderInterface;
use Sylius\Component\Core\Repository\OrderRepositoryInterface;
use Sylius\Component\Order\Context\CartContextInterface;
use Sylius\Component\Order\Context\CartNotFoundException;
use Sylius\Resource\Model\ResourceInterface;
use Sylius\TwigHooks\LiveComponent\HookableLiveComponentTrait;
use Symfony\UX\LiveComponent\Attribute\AsLiveComponent;
use Symfony\UX\LiveComponent\Attribute\LiveArg;
use Symfony\UX\LiveComponent\Attribute\LiveListener;
use Symfony\UX\LiveComponent\Attribute\LiveProp;
use Symfony\UX\LiveComponent\DefaultActionTrait;
use Symfony\UX\TwigComponent\Attribute\PreMount;
#[AsLiveComponent]
class WidgetComponent
{
use DefaultActionTrait;
use HookableLiveComponentTrait;
use TemplatePropTrait;
/** @use ResourceLivePropTrait<OrderInterface> */
use ResourceLivePropTrait;
#[LiveProp(hydrateWith: 'hydrateResource', dehydrateWith: 'dehydrateResource')]
public ?ResourceInterface $cart = null;
public function __construct(
protected readonly CartContextInterface $cartContext,
OrderRepositoryInterface $orderRepository,
) {
$this->initialize($orderRepository);
}
#[PreMount]
public function initializeCart(): void
{
$this->cart = $this->getCart();
}
#[LiveListener(FormComponent::SYLIUS_SHOP_CART_CHANGED)]
#[LiveListener(FormComponent::SYLIUS_SHOP_CART_CLEARED)]
public function refreshCart(#[LiveArg] mixed $cartId = null): void
{
// Fix: ignore user-supplied cartId, always load from session
$this->cart = $this->getCart();
}
private function getCart(): ?OrderInterface
{
try {
return $this->cartContext->getCart();
} catch (CartNotFoundException) {
return null;
}
return $cart;
}
}
Step 4. Override cart SummaryComponent
Create src/Twig/Components/Cart/SummaryComponent.php:
<?php
declare(strict_types=1);
namespace App\Twig\Components\Cart;
use Sylius\Bundle\ShopBundle\Twig\Component\Cart\FormComponent;
use Sylius\Bundle\UiBundle\Twig\Component\ResourceLivePropTrait;
use Sylius\Bundle\UiBundle\Twig\Component\TemplatePropTrait;
use Sylius\Component\Core\Model\OrderInterface;
use Sylius\Component\Core\Repository\OrderRepositoryInterface;
use Sylius\Resource\Model\ResourceInterface;
use Sylius\TwigHooks\LiveComponent\HookableLiveComponentTrait;
use Symfony\UX\LiveComponent\Attribute\AsLiveComponent;
use Symfony\UX\LiveComponent\Attribute\LiveArg;
use Symfony\UX\LiveComponent\Attribute\LiveListener;
use Symfony\UX\LiveComponent\Attribute\LiveProp;
use Symfony\UX\LiveComponent\DefaultActionTrait;
#[AsLiveComponent]
class SummaryComponent
{
use DefaultActionTrait;
use HookableLiveComponentTrait;
/** @use ResourceLivePropTrait<OrderInterface> */
use ResourceLivePropTrait;
use TemplatePropTrait;
#[LiveProp(hydrateWith: 'hydrateResource', dehydrateWith: 'dehydrateResource')]
public ?ResourceInterface $cart = null;
/** @param OrderRepositoryInterface<OrderInterface> $orderRepository */
public function __construct(OrderRepositoryInterface $orderRepository)
{
$this->initialize($orderRepository);
}
#[LiveListener(FormComponent::SYLIUS_SHOP_CART_CHANGED)]
public function refreshCart(#[LiveArg] mixed $cartId): void
{
// Fix: ignore user-supplied cartId, reload from checksummed cart prop
if ($this->cart === null) {
return;
}
$this->cart = $this->hydrateResource($this->cart->getId());
}
}
Step 5. Register overridden services
In config/services.yaml, add:
sylius_shop.twig.component.checkout.address.form:
class: App\Twig\Components\Checkout\Address\FormComponent
arguments:
$repository: '@sylius.repository.order'
$formFactory: '@form.factory'
$resourceClass: '%sylius.model.order.class%'
$formClass: 'Sylius\Bundle\ShopBundle\Form\Type\Checkout\AddressType'
$customerContext: '@sylius.context.customer'
$shopUserRepository: '@sylius.repository.shop_user'
$addressRepository: '@sylius.repository.address'
tags:
- { name: 'sylius.live_component.shop', key: 'sylius_shop:checkout:address:form' }
sylius_shop.twig.component.cart.widget:
class: App\Twig\Components\Cart\WidgetComponent
arguments:
$cartContext: '@sylius.context.cart.composite'
$orderRepository: '@sylius.repository.order'
tags:
- { name: 'sylius.live_component.shop', key: 'sylius_shop:cart:widget' }
sylius_shop.twig.component.cart.summary:
class: App\Twig\Components\Cart\SummaryComponent
arguments:
$orderRepository: '@sylius.repository.order'
tags:
- { name: 'sylius.live_component.shop', key: 'sylius_shop:cart:summary' }
Step 6. Clear cache
php bin/console cache:clear
Reporters
We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability: - Peter Stöckli (@p-) - Man Yue Mo (@m-y-mo) - The GitHub Security Lab team
For more information
If you have any questions or comments about this advisory:
- Open an issue in Sylius issues
- Email us at security@sylius.com
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.15"
},
"package": {
"ecosystem": "Packagist",
"name": "sylius/sylius"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.1.11"
},
"package": {
"ecosystem": "Packagist",
"name": "sylius/sylius"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.2.2"
},
"package": {
"ecosystem": "Packagist",
"name": "sylius/sylius"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-31820"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-11T00:12:47Z",
"nvd_published_at": "2026-03-10T22:16:19Z",
"severity": "HIGH"
},
"details": "### Impact\nAn authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via `#[LiveArg]` parameters. Unlike props, which are protected by LiveComponent\u0027s `@checksum`, `args` are fully user-controlled - any action that accepts a resource ID via `#[LiveArg]` and loads it with `-\u003efind()` without ownership validation is vulnerable.\n\nCheckout address **FormComponent** (`addressFieldUpdated` action): Accepts an `addressId` via `#[LiveArg]` and loads it without verifying ownership, exposing another user\u0027s first name, last name, company, phone number, street, city, postcode, and country.\n\nCart **WidgetComponent** (`refreshCart` action): Accepts a `cartId` via `#[LiveArg]` and loads any order directly from the repository, exposing order total and item count.\n\nCart **SummaryComponent** (`refreshCart` action): Accepts a `cartId` via `#[LiveArg]` and loads any order directly from the repository, exposing subtotal, discount, shipping cost, taxes (excluded and included), and order total.\n\nSince `sylius_order` contains both active carts (`state=cart`) and completed orders (`state=new/fulfilled`) in the same ID space, the cart IDOR exposes data from all orders, not just active carts.\n\n### Patches\nThe issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.\n\n### Workarounds\n\nOverride vulnerable LiveComponent classes at the project level to add authorization checks to `#[LiveArg]` parameters.\n\n#### Step 1. Exclude component overrides from default autowiring\n\nIn `config/services.yaml`, add `Twig/Component` to the exclude list to prevent duplicate service registration:\n\n```yaml\nApp\\:\n resource: \u0027../src/*\u0027\n exclude: \u0027../src/{Entity,Kernel.php,Twig/Components}\u0027\n```\n\n#### Step 2. Override checkout address FormComponent\n\nCreate `src/Twig/Components/Checkout/Address/FormComponent.php`:\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\Twig\\Components\\Checkout\\Address;\n\nuse Sylius\\Bundle\\ShopBundle\\Twig\\Component\\Checkout\\Address\\AddressBookComponent;\nuse Sylius\\Bundle\\UiBundle\\Twig\\Component\\ResourceFormComponentTrait;\nuse Sylius\\Bundle\\UiBundle\\Twig\\Component\\TemplatePropTrait;\nuse Sylius\\Component\\Core\\Model\\OrderInterface;\nuse Sylius\\Component\\Core\\Model\\ShopUserInterface;\nuse Sylius\\Component\\Core\\Repository\\AddressRepositoryInterface;\nuse Sylius\\Component\\Core\\Repository\\OrderRepositoryInterface;\nuse Sylius\\Component\\Customer\\Context\\CustomerContextInterface;\nuse Sylius\\Component\\User\\Repository\\UserRepositoryInterface;\nuse Symfony\\Component\\Form\\FormFactoryInterface;\nuse Symfony\\Component\\Form\\FormInterface;\nuse Symfony\\UX\\LiveComponent\\Attribute\\AsLiveComponent;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveArg;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveListener;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveProp;\nuse Symfony\\UX\\LiveComponent\\Attribute\\PreReRender;\n\n#[AsLiveComponent]\nclass FormComponent\n{\n /** @use ResourceFormComponentTrait\u003cOrderInterface\u003e */\n use ResourceFormComponentTrait;\n use TemplatePropTrait;\n\n #[LiveProp]\n public bool $emailExists = false;\n\n /**\n * @param OrderRepositoryInterface\u003cOrderInterface\u003e $repository\n * @param UserRepositoryInterface\u003cShopUserInterface\u003e $shopUserRepository\n */\n public function __construct(\n OrderRepositoryInterface $repository,\n FormFactoryInterface $formFactory,\n string $resourceClass,\n string $formClass,\n protected readonly CustomerContextInterface $customerContext,\n protected readonly UserRepositoryInterface $shopUserRepository,\n protected readonly AddressRepositoryInterface $addressRepository,\n ) {\n $this-\u003einitialize($repository, $formFactory, $resourceClass, $formClass);\n }\n\n #[PreReRender(priority: -100)]\n public function checkEmailExist(): void\n {\n $email = $this-\u003eformValues[\u0027customer\u0027][\u0027email\u0027] ?? null;\n if (null !== $email) {\n $this-\u003eemailExists = $this-\u003eshopUserRepository-\u003efindOneByEmail($email) !== null;\n }\n }\n\n #[LiveListener(AddressBookComponent::SYLIUS_SHOP_ADDRESS_UPDATED)]\n public function addressFieldUpdated(#[LiveArg] mixed $addressId, #[LiveArg] string $field): void\n {\n $customer = $this-\u003ecustomerContext-\u003egetCustomer();\n if (null === $customer) {\n return;\n }\n\n // Fix: findOneByCustomer instead of find \u2014 validates ownership\n $address = $this-\u003eaddressRepository-\u003efindOneByCustomer((string) $addressId, $customer);\n if (null === $address) {\n return;\n }\n\n $newAddress = [];\n $newAddress[\u0027firstName\u0027] = $address-\u003egetFirstName();\n $newAddress[\u0027lastName\u0027] = $address-\u003egetLastName();\n $newAddress[\u0027phoneNumber\u0027] = $address-\u003egetPhoneNumber();\n $newAddress[\u0027company\u0027] = $address-\u003egetCompany();\n $newAddress[\u0027countryCode\u0027] = $address-\u003egetCountryCode();\n if ($address-\u003egetProvinceCode() !== null) {\n $newAddress[\u0027provinceCode\u0027] = $address-\u003egetProvinceCode();\n }\n if ($address-\u003egetProvinceName() !== null) {\n $newAddress[\u0027provinceName\u0027] = $address-\u003egetProvinceName();\n }\n $newAddress[\u0027street\u0027] = $address-\u003egetStreet();\n $newAddress[\u0027city\u0027] = $address-\u003egetCity();\n $newAddress[\u0027postcode\u0027] = $address-\u003egetPostcode();\n\n $this-\u003eformValues[$field] = $newAddress;\n }\n\n protected function instantiateForm(): FormInterface\n {\n return $this-\u003eformFactory-\u003ecreate(\n $this-\u003eformClass,\n $this-\u003eresource,\n [\u0027customer\u0027 =\u003e $this-\u003ecustomerContext-\u003egetCustomer()],\n );\n }\n}\n```\n\n#### Step 3. Override cart WidgetComponent\n\nCreate `src/Twig/Components/Cart/WidgetComponent.php`:\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\Twig\\Components\\Cart;\n\nuse Sylius\\Bundle\\ShopBundle\\Twig\\Component\\Cart\\FormComponent;\nuse Sylius\\Bundle\\UiBundle\\Twig\\Component\\ResourceLivePropTrait;\nuse Sylius\\Bundle\\UiBundle\\Twig\\Component\\TemplatePropTrait;\nuse Sylius\\Component\\Core\\Model\\OrderInterface;\nuse Sylius\\Component\\Core\\Repository\\OrderRepositoryInterface;\nuse Sylius\\Component\\Order\\Context\\CartContextInterface;\nuse Sylius\\Component\\Order\\Context\\CartNotFoundException;\nuse Sylius\\Resource\\Model\\ResourceInterface;\nuse Sylius\\TwigHooks\\LiveComponent\\HookableLiveComponentTrait;\nuse Symfony\\UX\\LiveComponent\\Attribute\\AsLiveComponent;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveArg;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveListener;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveProp;\nuse Symfony\\UX\\LiveComponent\\DefaultActionTrait;\nuse Symfony\\UX\\TwigComponent\\Attribute\\PreMount;\n\n#[AsLiveComponent]\nclass WidgetComponent\n{\n use DefaultActionTrait;\n use HookableLiveComponentTrait;\n use TemplatePropTrait;\n\n /** @use ResourceLivePropTrait\u003cOrderInterface\u003e */\n use ResourceLivePropTrait;\n\n #[LiveProp(hydrateWith: \u0027hydrateResource\u0027, dehydrateWith: \u0027dehydrateResource\u0027)]\n public ?ResourceInterface $cart = null;\n\n public function __construct(\n protected readonly CartContextInterface $cartContext,\n OrderRepositoryInterface $orderRepository,\n ) {\n $this-\u003einitialize($orderRepository);\n }\n\n #[PreMount]\n public function initializeCart(): void\n {\n $this-\u003ecart = $this-\u003egetCart();\n }\n\n #[LiveListener(FormComponent::SYLIUS_SHOP_CART_CHANGED)]\n #[LiveListener(FormComponent::SYLIUS_SHOP_CART_CLEARED)]\n public function refreshCart(#[LiveArg] mixed $cartId = null): void\n {\n // Fix: ignore user-supplied cartId, always load from session\n $this-\u003ecart = $this-\u003egetCart();\n }\n\n private function getCart(): ?OrderInterface\n {\n try {\n return $this-\u003ecartContext-\u003egetCart();\n } catch (CartNotFoundException) {\n return null;\n }\n\n return $cart;\n }\n}\n```\n\n#### Step 4. Override cart SummaryComponent\n\nCreate `src/Twig/Components/Cart/SummaryComponent.php`:\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\Twig\\Components\\Cart;\n\nuse Sylius\\Bundle\\ShopBundle\\Twig\\Component\\Cart\\FormComponent;\nuse Sylius\\Bundle\\UiBundle\\Twig\\Component\\ResourceLivePropTrait;\nuse Sylius\\Bundle\\UiBundle\\Twig\\Component\\TemplatePropTrait;\nuse Sylius\\Component\\Core\\Model\\OrderInterface;\nuse Sylius\\Component\\Core\\Repository\\OrderRepositoryInterface;\nuse Sylius\\Resource\\Model\\ResourceInterface;\nuse Sylius\\TwigHooks\\LiveComponent\\HookableLiveComponentTrait;\nuse Symfony\\UX\\LiveComponent\\Attribute\\AsLiveComponent;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveArg;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveListener;\nuse Symfony\\UX\\LiveComponent\\Attribute\\LiveProp;\nuse Symfony\\UX\\LiveComponent\\DefaultActionTrait;\n\n#[AsLiveComponent]\nclass SummaryComponent\n{\n use DefaultActionTrait;\n use HookableLiveComponentTrait;\n\n /** @use ResourceLivePropTrait\u003cOrderInterface\u003e */\n use ResourceLivePropTrait;\n use TemplatePropTrait;\n\n #[LiveProp(hydrateWith: \u0027hydrateResource\u0027, dehydrateWith: \u0027dehydrateResource\u0027)]\n public ?ResourceInterface $cart = null;\n\n /** @param OrderRepositoryInterface\u003cOrderInterface\u003e $orderRepository */\n public function __construct(OrderRepositoryInterface $orderRepository)\n {\n $this-\u003einitialize($orderRepository);\n }\n\n #[LiveListener(FormComponent::SYLIUS_SHOP_CART_CHANGED)]\n public function refreshCart(#[LiveArg] mixed $cartId): void\n {\n // Fix: ignore user-supplied cartId, reload from checksummed cart prop\n if ($this-\u003ecart === null) {\n return;\n }\n\n $this-\u003ecart = $this-\u003ehydrateResource($this-\u003ecart-\u003egetId());\n }\n}\n```\n\n#### Step 5. Register overridden services\n\nIn `config/services.yaml`, add:\n\n```yaml\n sylius_shop.twig.component.checkout.address.form:\n class: App\\Twig\\Components\\Checkout\\Address\\FormComponent\n arguments:\n $repository: \u0027@sylius.repository.order\u0027\n $formFactory: \u0027@form.factory\u0027\n $resourceClass: \u0027%sylius.model.order.class%\u0027\n $formClass: \u0027Sylius\\Bundle\\ShopBundle\\Form\\Type\\Checkout\\AddressType\u0027\n $customerContext: \u0027@sylius.context.customer\u0027\n $shopUserRepository: \u0027@sylius.repository.shop_user\u0027\n $addressRepository: \u0027@sylius.repository.address\u0027\n tags:\n - { name: \u0027sylius.live_component.shop\u0027, key: \u0027sylius_shop:checkout:address:form\u0027 }\n\n sylius_shop.twig.component.cart.widget:\n class: App\\Twig\\Components\\Cart\\WidgetComponent\n arguments:\n $cartContext: \u0027@sylius.context.cart.composite\u0027\n $orderRepository: \u0027@sylius.repository.order\u0027\n tags:\n - { name: \u0027sylius.live_component.shop\u0027, key: \u0027sylius_shop:cart:widget\u0027 }\n\n sylius_shop.twig.component.cart.summary:\n class: App\\Twig\\Components\\Cart\\SummaryComponent\n arguments:\n $orderRepository: \u0027@sylius.repository.order\u0027\n tags:\n - { name: \u0027sylius.live_component.shop\u0027, key: \u0027sylius_shop:cart:summary\u0027 }\n```\n\n#### Step 6. Clear cache\n\n```bash\nphp bin/console cache:clear\n```\n\n### Reporters\n\nWe would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability:\n- Peter St\u00f6ckli (@p-)\n- Man Yue Mo (@m-y-mo)\n- The [GitHub Security Lab](https://securitylab.github.com) team\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen)\n- Email us at [security@sylius.com](mailto:security@sylius.com)",
"id": "GHSA-2xc6-348p-c2x6",
"modified": "2026-03-11T05:46:26Z",
"published": "2026-03-11T00:12:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-2xc6-348p-c2x6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31820"
},
{
"type": "PACKAGE",
"url": "https://github.com/Sylius/Sylius"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Sylius affected by IDOR in Cart and Checkout LiveComponents"
}
GHSA-2XCP-X87W-Q377
Vulnerability from github – Published: 2026-04-25 23:45 – Updated: 2026-05-19 15:56Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
< 2026.4.20 - Patched version:
2026.4.20
Impact
Templated hook mapping sessionKey values were treated differently from request-supplied session keys. A hook mapping could render an externally influenced session key even when hooks.allowRequestSessionKey was disabled, bypassing the intended routing opt-in for hook callers.
This affects webhook routing isolation. It does not grant host execution by itself. Severity is medium.
Fix
Template-rendered mapping session keys are now treated as externally supplied routing input and require hooks.allowRequestSessionKey=true plus the existing prefix policy checks.
Fix commit:
5275d008ed33203dba3f98e969ad683a65c416c3
Release
Fixed in OpenClaw 2026.4.20.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.4.20"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45002"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-25T23:45:11Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c 2026.4.20`\n- Patched version: `2026.4.20`\n\n## Impact\n\nTemplated hook mapping `sessionKey` values were treated differently from request-supplied session keys. A hook mapping could render an externally influenced session key even when `hooks.allowRequestSessionKey` was disabled, bypassing the intended routing opt-in for hook callers.\n\nThis affects webhook routing isolation. It does not grant host execution by itself. Severity is medium.\n\n## Fix\n\nTemplate-rendered mapping session keys are now treated as externally supplied routing input and require `hooks.allowRequestSessionKey=true` plus the existing prefix policy checks.\n\nFix commit:\n\n- `5275d008ed33203dba3f98e969ad683a65c416c3`\n\n## Release\n\nFixed in OpenClaw `2026.4.20`.",
"id": "GHSA-2xcp-x87w-q377",
"modified": "2026-05-19T15:56:34Z",
"published": "2026-04-25T23:45:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-2xcp-x87w-q377"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45002"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/5275d008ed33203dba3f98e969ad683a65c416c3"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-hook-session-key-bypass-via-template-mapping"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Hook mapping templates could bypass hook session-key opt-in"
}
GHSA-2XFC-G69J-X2MP
Vulnerability from github – Published: 2026-03-03 21:00 – Updated: 2026-03-04 18:39Description
The entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds[] (or authorId) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others.
Normally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively "spoofs" the authorship.
Proof of Concept
Prerequisites
- A user account with "Create Entries" permission for a section.
- Victim's account ID (e.g.,
1for the default Admin).
Steps to Reproduce
- Log in as the attacker
- Navigate to the "Entries" section and click "New Entry"
- Fill in the required fields
- Enable a proxy tool (e.g., Burp Suite) to intercept requests
- Click "Save" & Intercept the request
- In the request body, add a new parameter to the body params:
&authorIds[]=<Victim_ID> - Forward the request
- Log in as an admin / as with the victim account
- Go to entries & Observe the newly created entry is listed and the author is the victim account, not the actual creator
Impact
- A user can create entries that appear to belong to higher-privileged users, potentially bypassing review processes or gaining trust based on false authorship.
- An attacker could post malicious or inappropriate content attributed to an administrator or other trusted users.
Resources
https://github.com/craftcms/cms/commit/c6dcbdffaf6ab3ffe77d317336684d83699f4542 https://github.com/craftcms/cms/commit/830b403870cd784b47ae42a3f5a16e7ac2d7f5a8
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0-RC1"
},
{
"fixed": "5.9.0-beta.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-RC1"
},
{
"fixed": "4.17.0-beta.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-28781"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-03T21:00:51Z",
"nvd_published_at": "2026-03-04T17:16:21Z",
"severity": "MODERATE"
},
"details": "## Description\nThe entry creation process allows for **Mass Assignment** of the `authorId` attribute. A user with \"Create Entries\" permission can inject the `authorIds[]` (or `authorId`) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others.\n\nNormally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively \"spoofs\" the authorship.\n\n## Proof of Concept\n### Prerequisites\n- A user account with \"Create Entries\" permission for a section.\n- Victim\u0027s account ID (e.g., `1` for the default Admin).\n\n### Steps to Reproduce\n1. Log in as the attacker\n1. Navigate to the \"Entries\" section and click \"New Entry\"\n1. Fill in the required fields\n1. Enable a proxy tool (e.g., Burp Suite) to intercept requests\n1. Click \"Save\" \u0026 Intercept the request\n1. In the request body, add a new parameter to the body params: `\u0026authorIds[]=\u003cVictim_ID\u003e`\n1. Forward the request\n1. Log in as an admin / as with the victim account\n1. Go to entries \u0026 Observe the newly created entry is listed and the author is the victim account, not the actual creator\n\n## Impact\n- A user can create entries that appear to belong to higher-privileged users, potentially bypassing review processes or gaining trust based on false authorship.\n- An attacker could post malicious or inappropriate content attributed to an administrator or other trusted users.\n\n## Resources\n\nhttps://github.com/craftcms/cms/commit/c6dcbdffaf6ab3ffe77d317336684d83699f4542\nhttps://github.com/craftcms/cms/commit/830b403870cd784b47ae42a3f5a16e7ac2d7f5a8",
"id": "GHSA-2xfc-g69j-x2mp",
"modified": "2026-03-04T18:39:05Z",
"published": "2026-03-03T21:00:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-2xfc-g69j-x2mp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28781"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/830b403870cd784b47ae42a3f5a16e7ac2d7f5a8"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/c6dcbdffaf6ab3ffe77d317336684d83699f4542"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftcms/cms"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Craft CMS: Entries Authorship Spoofing via Mass Assignment"
}
GHSA-2XG8-969F-84GV
Vulnerability from github – Published: 2026-05-28 06:31 – Updated: 2026-05-28 06:31The Meta Field Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.5.1. This is due to the plugin allowing users to specify arbitrary object IDs and object types via block attributes without validating whether the authenticated user has permission to access the requested object's metadata. This makes it possible for authenticated attackers, with Contributor-level access and above, to read arbitrary user meta, post meta, and term meta data from any object in the database. On sites using plugins that store sensitive data in meta fields (e.g., WooCommerce billing/shipping information), this could lead to the exposure of Personally Identifiable Information (PII) including names, email addresses, phone numbers, and physical addresses.
{
"affected": [],
"aliases": [
"CVE-2026-3173"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T06:16:26Z",
"severity": "MODERATE"
},
"details": "The Meta Field Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.5.1. This is due to the plugin allowing users to specify arbitrary object IDs and object types via block attributes without validating whether the authenticated user has permission to access the requested object\u0027s metadata. This makes it possible for authenticated attackers, with Contributor-level access and above, to read arbitrary user meta, post meta, and term meta data from any object in the database. On sites using plugins that store sensitive data in meta fields (e.g., WooCommerce billing/shipping information), this could lead to the exposure of Personally Identifiable Information (PII) including names, email addresses, phone numbers, and physical addresses.",
"id": "GHSA-2xg8-969f-84gv",
"modified": "2026-05-28T06:31:09Z",
"published": "2026-05-28T06:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3173"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/display-a-meta-field-as-block/trunk/meta-field-block.php#L206"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/display-a-meta-field-as-block/trunk/meta-field-block.php#L328"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3472303"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/247df9e2-0a63-49ad-86fa-cb4c6e62c4cf?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2XGC-784M-6J64
Vulnerability from github – Published: 2026-06-15 21:30 – Updated: 2026-06-15 21:30Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.
{
"affected": [],
"aliases": [
"CVE-2026-52699"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-15T21:17:24Z",
"severity": "HIGH"
},
"details": "Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar \u003c= 1.4.5 versions.",
"id": "GHSA-2xgc-784m-6j64",
"modified": "2026-06-15T21:30:50Z",
"published": "2026-06-15T21:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52699"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/vikrentcar/vulnerability/wordpress-vikrentcar-plugin-1-4-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2XGG-2X8H-8XW4
Vulnerability from github – Published: 2026-07-14 00:09 – Updated: 2026-07-14 00:09Summary
Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the Web rate editing flows for projects, customers, and activities. A user who can edit one authorized parent object can combine that authorized parent ID with the rate ID of a different, unauthorized parent object and thereby modify the unauthorized rate record.
This affects ProjectRate, CustomerRate, and ActivityRate editing. The issue is caused by missing parent-child consistency validation and allows cross-project, cross-customer, or cross-activity tampering of billing-related configuration.
Details
The issue affects the following Web routes:
GET/POST /en/admin/project/{id}/rate/{rate}GET/POST /en/admin/customer/{id}/rate/{rate}GET/POST /en/admin/activity/{id}/rate/{rate}
In both cases, the parent object and the rate object are resolved independently from user-controlled route parameters. The controller only checks whether the current user may edit the parent object referenced by {id}, but it does not verify that the child rate object referenced by {rate} actually belongs to that same parent.
In these controllers, there is no validation such as:
$rate->getProject() === $project$rate->getCustomer() === $customer$rate->getActivity() === $activity
This missing binding check is especially notable because the API delete endpoints already enforce the expected parent-child relationship.
This shows that parent-child consistency is already a recognized invariant in the application design, but the Web edit endpoints fail to enforce it for projects, customers, and activities.
A PoC was provided, but removed for security reasons.
Impact
This vulnerability allows authenticated users to tamper with billing-related rate configuration outside their authorized project, customer, or activity scope. An attacker can modify rate values belonging to other teams or business domains, which can affect time-based settlement, inherited pricing, cost calculations, budget reporting, revenue reporting, and downstream invoice generation.
Because the issue directly persists changes into kimai2_projects_rates, kimai2_customers_rates, and kimai2_activities_rates, it is a real cross-scope integrity vulnerability rather than a UI-only flaw. The attack breaks team-based isolation boundaries for high-value financial configuration.
Solution
The rate edit forms for customers, projects and activities now verify that the rate belongs to the parent referenced in the URL and reject the request otherwise.
See https://www.kimai.org/en/security/ghsa-2xgg-2x8h-8xw4 for more information.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.56.0"
},
"package": {
"ecosystem": "Packagist",
"name": "kimai/kimai"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.57.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-52826"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-14T00:09:35Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nKimai 2.56.0 contains an authenticated improper authorization vulnerability in the Web rate editing flows for projects, customers, and activities. A user who can edit one authorized parent object can combine that authorized parent ID with the rate ID of a different, unauthorized parent object and thereby modify the unauthorized rate record.\n\nThis affects `ProjectRate`, `CustomerRate`, and `ActivityRate` editing. The issue is caused by missing parent-child consistency validation and allows cross-project, cross-customer, or cross-activity tampering of billing-related configuration.\n\n### Details\n\nThe issue affects the following Web routes:\n\n- `GET/POST /en/admin/project/{id}/rate/{rate}`\n- `GET/POST /en/admin/customer/{id}/rate/{rate}`\n- `GET/POST /en/admin/activity/{id}/rate/{rate}`\n\nIn both cases, the parent object and the rate object are resolved independently from user-controlled route parameters. The controller only checks whether the current user may edit the parent object referenced by `{id}`, but it does not verify that the child rate object referenced by `{rate}` actually belongs to that same parent.\n\nIn these controllers, there is no validation such as:\n\n- `$rate-\u003egetProject() === $project`\n- `$rate-\u003egetCustomer() === $customer`\n- `$rate-\u003egetActivity() === $activity`\n\nThis missing binding check is especially notable because the API delete endpoints already enforce the expected parent-child relationship.\n\nThis shows that parent-child consistency is already a recognized invariant in the application design, but the Web edit endpoints fail to enforce it for projects, customers, and activities.\n\n*A PoC was provided, but removed for security reasons.*\n\n### Impact\n\nThis vulnerability allows authenticated users to tamper with billing-related rate configuration outside their authorized project, customer, or activity scope. An attacker can modify rate values belonging to other teams or business domains, which can affect time-based settlement, inherited pricing, cost calculations, budget reporting, revenue reporting, and downstream invoice generation.\n\nBecause the issue directly persists changes into `kimai2_projects_rates`, `kimai2_customers_rates`, and `kimai2_activities_rates`, it is a real cross-scope integrity vulnerability rather than a UI-only flaw. The attack breaks team-based isolation boundaries for high-value financial configuration.\n\n# Solution\n\nThe rate edit forms for `customers`, `projects` and `activities` now verify that the rate belongs to the parent referenced in the URL and reject the request otherwise.\n\nSee [https://www.kimai.org/en/security/ghsa-2xgg-2x8h-8xw4](https://www.kimai.org/en/security/ghsa-2xgg-2x8h-8xw4) for more information.",
"id": "GHSA-2xgg-2x8h-8xw4",
"modified": "2026-07-14T00:09:35Z",
"published": "2026-07-14T00:09:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kimai/kimai/security/advisories/GHSA-2xgg-2x8h-8xw4"
},
{
"type": "PACKAGE",
"url": "https://github.com/kimai/kimai"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation"
}
GHSA-2XGM-WC4G-5JVG
Vulnerability from github – Published: 2026-07-22 22:24 – Updated: 2026-07-22 22:24Impact
An authenticated user with permission to create workflows in one project could bypass project/folder authorization boundaries during workflow creation. By supplying a crafted request payload, the user could associate a newly created workflow with a folder belonging to a different project they do not have access to.
The workflow itself remains in the attacker's project and is not visible to the target project's members. The target project's folder ownership is not changed, and no data from the target project is exposed. The impact is limited to a logical integrity violation of the target project's folder structure at the database level.
This issue affects instances with multi-project and folder support enabled.
Patches
The issue has been fixed in n8n version 2.28.0. Users should upgrade to this version or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict project membership and workflow creation permissions to fully trusted users only.
This workaround does not fully remediate the risk and should only be used as a short-term mitigation measure.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.28.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59253"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T22:24:43Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Impact\nAn authenticated user with permission to create workflows in one project could bypass project/folder authorization boundaries during workflow creation. By supplying a crafted request payload, the user could associate a newly created workflow with a folder belonging to a different project they do not have access to.\n\nThe workflow itself remains in the attacker\u0027s project and is not visible to the target project\u0027s members. The target project\u0027s folder ownership is not changed, and no data from the target project is exposed. The impact is limited to a logical integrity violation of the target project\u0027s folder structure at the database level.\n\nThis issue affects instances with multi-project and folder support enabled.\n\n## Patches\nThe issue has been fixed in n8n version 2.28.0. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict project membership and workflow creation permissions to fully trusted users only.\n\nThis workaround does not fully remediate the risk and should only be used as a short-term mitigation measure.",
"id": "GHSA-2xgm-wc4g-5jvg",
"modified": "2026-07-22T22:24:43Z",
"published": "2026-07-22T22:24:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2xgm-wc4g-5jvg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59253"
},
{
"type": "PACKAGE",
"url": "https://github.com/n8n-io/n8n"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.28.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-improper-authorization-in-workflow-assignment-to-folders"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects"
}
GHSA-2XJ9-M79M-CHVG
Vulnerability from github – Published: 2026-10-30 21:32 – Updated: 2026-10-30 21:32NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.
{
"affected": [],
"aliases": [
"CVE-2026-120007"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-30T19:18:22Z",
"severity": "MODERATE"
},
"details": "NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim\u0027s email and confirmation state and revoke all their sessions.",
"id": "GHSA-2xj9-m79m-chvg",
"modified": "2026-10-30T21:32:18Z",
"published": "2026-10-30T21:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120007"
},
{
"type": "WEB",
"url": "https://github.com/NodeBB/NodeBB/commit/376d14abb7fffd8ea14f3a2f96baa20ffee5cdb3"
},
{
"type": "WEB",
"url": "https://github.com/NodeBB/NodeBB"
},
{
"type": "WEB",
"url": "https://github.com/NodeBB/NodeBB/blob/c3d8dc512292a376f19e06cb93512bdff2505102/src/controllers/authentication.js#L34"
},
{
"type": "WEB",
"url": "https://github.com/NodeBB/NodeBB/blob/c3d8dc512292a376f19e06cb93512bdff2505102/src/user/interstitials.js#L124"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nodebb-1.18.0-through-4.16.5-authorization-bypass-via-register-complete-uid"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.