CWE-639
Weakness AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system.
For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Relationships and members
Modes of introduction
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Retrieval of a user record occurs in the system based on some key value that is under user control. The key would typically identify a user-related record stored in the system and would be used to lookup that record for presentation to the user.
One manifestation of this weakness is when a system uses sequential or otherwise easily-guessable session IDs that would allow one user to easily switch to another user's session and read/modify their data.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Notes
Maintenance
As of CWE 4.20, the relationship between IDOR and BOLA needs to be investigated more closely, including research into how these terms are used in the industry. The CWE team suspects that IDOR can be a part of BOLA, but BOLA expands on the weakness inherent to IDOR in that it is not only about objects that are being directly referenced.
Content history
Suggested corrections to use of IDOR versus BOLA
updated Common_Consequences, Relationships, Type
updated Description
updated Relationships
updated Relationships
updated Common_Consequences
updated Relationships
updated Alternate_Terms, Applicable_Platforms, Description, Name, Potential_Mitigations, Relationships
updated Common_Consequences, Relationships
updated Relationships
updated Alternate_Terms, Common_Consequences
updated Relationships
updated Relationships
updated Description, Enabling_Factors_for_Exploitation, Modes_of_Introduction, Relationships
updated Relationships
updated Relationships
updated Relationships
updated Alternate_Terms
updated Relationships
updated Alternate_Terms
updated Relationships
updated Detection_Factors, Relationships
updated Mapping_Notes
updated Observed_Examples
updated Demonstrative_Examples
updated References, Relationships, Weakness_Ordinalities
updated Alternate_Terms, Maintenance_Notes, References
updated Description, Modes_of_Introduction, Time_of_Introduction
5710 vulnerabilities reference this CWE, most recent first.
GHSA-3FWG-9P8X-37MV
Vulnerability from github – Published: 2026-09-20 00:30 – Updated: 2026-09-20 00:30Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.
{
"affected": [],
"aliases": [
"CVE-2026-93991"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-19T23:17:10Z",
"severity": "HIGH"
},
"details": "Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.",
"id": "GHSA-3fwg-9p8x-37mv",
"modified": "2026-09-20T00:30:23Z",
"published": "2026-09-20T00:30:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-q65w-j2vp-47c4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93991"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-workflows/commit/a40972386c097ddf816d2e60e13f058bedca53d9"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-workflows"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-workflows/releases/tag/v4.1.4"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/argo-workflows-4.1.0-through-4.1.3-cross-namespace-disclosure-via-negated-selector"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3FX2-9CXR-PGRX
Vulnerability from github – Published: 2024-05-14 15:32 – Updated: 2024-05-14 15:32The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary folder name that do not belong to them.
{
"affected": [],
"aliases": [
"CVE-2024-1693"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T14:48:34Z",
"severity": "MODERATE"
},
"details": "The SP Project \u0026 Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary folder name that do not belong to them.",
"id": "GHSA-3fx2-9cxr-pgrx",
"modified": "2024-05-14T15:32:52Z",
"published": "2024-05-14T15:32:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1693"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L786"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1951ad6c-17b5-44ae-85e2-376b99df742e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3GFX-J948-6JM4
Vulnerability from github – Published: 2026-10-31 18:30 – Updated: 2026-10-31 18:30LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.
{
"affected": [],
"aliases": [
"CVE-2026-120199"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-31T18:17:07Z",
"severity": "MODERATE"
},
"details": "LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users\u0027 grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students\u0027 work, grades and instructor feedback.",
"id": "GHSA-3gfx-j948-6jm4",
"modified": "2026-10-31T18:30:22Z",
"published": "2026-10-31T18:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120199"
},
{
"type": "WEB",
"url": "https://github.com/learnhouse/learnhouse/issues/1184"
},
{
"type": "WEB",
"url": "https://github.com/learnhouse/learnhouse/pull/1187"
},
{
"type": "WEB",
"url": "https://github.com/learnhouse/learnhouse/commit/844a8a7787f0c42d466be604aaf47d296748b1b3"
},
{
"type": "WEB",
"url": "https://github.com/learnhouse/learnhouse"
},
{
"type": "WEB",
"url": "https://github.com/learnhouse/learnhouse/blob/1.1.0/apps/api/src/services/courses/activities/assignments.py#L1673"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/learnhouse-before-1.1.1-missing-authorization-via-assignment-submissions-api"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3GHG-3787-W2XR
Vulnerability from github – Published: 2026-01-08 21:28 – Updated: 2026-01-11 14:56Summary
An Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies.
Details
During testing, it was observed that all guest users can make an unauthenticated request to retrieve address data belonging to other guest users by manipulating object identifiers. The attacker would need to know the storefront URL structure to perform this attack (which can be learnt after creating a registered user account).
Affected Component(s)
* Address Edit endpoint: /addresses/{addressId}/edit
Root Cause - Faulty authorization check in CanCanCan Ability class:
- can :manage, ::Spree::Address, user_id: user.id
+ can :manage, ::Spree::Address, user_id: user.id if user.persisted?
the user object in Spree::Ability class for guest users is a Spree.user_class.new object.
Addresses endpoint to access it is part of the spree_storefront gem. Headless builds using APIs are not affected, as the Addresses endpoint there is only for registered users, and records are scoped to the currently signed-in user.
PoC
Preconditions - No authentication required - No cookies or session tokens set
To reproduce this vulnerability simply perform the request shown below, replacing the number with an arbitrary value.
For the initial request the Guest Address id = 6 is used to obtain the information
Request
GET /addresses/6/edit
Repeat the request and check the response, in this example using Guest Address id = 2.
Request
GET /addresses/2/edit
Impact
An unauthenticated attacker can:
- Enumerate and retrieve guest address information (Addresses associated with User accounts are NOT affected)
- Access personally identifiable information (PII) such as:
- Full names
- Physical addresses
- Phone numbers (if present)
This vulnerability could lead to:
- Privacy violations
- Regulatory compliance issues (e.g., GDPR)
- Loss of user trust
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "spree_core"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.10.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "spree_core"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "spree_core"
},
"ranges": [
{
"events": [
{
"introduced": "5.1.0"
},
{
"fixed": "5.1.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "spree_core"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-22589"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-08T21:28:04Z",
"nvd_published_at": "2026-01-10T04:16:01Z",
"severity": "HIGH"
},
"details": "### Summary\nAn Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies.\n\n### Details\nDuring testing, it was observed that all guest users can make an unauthenticated request to retrieve address data belonging to other guest users by manipulating object identifiers. The attacker would need to know the storefront URL structure to perform this attack (which can be learnt after creating a registered user account).\n\nAffected Component(s)\n* Address Edit endpoint: `/addresses/{addressId}/edit`\n\nRoot Cause\n- Faulty authorization check in CanCanCan Ability class:\n\n```diff\n- can :manage, ::Spree::Address, user_id: user.id\n+ can :manage, ::Spree::Address, user_id: user.id if user.persisted?\n```\n\nthe `user` object in `Spree::Ability` class for guest users is a `Spree.user_class.new` object. \n\nAddresses endpoint to access it is part of the `spree_storefront` gem. **Headless builds using APIs are not affected,** as the Addresses endpoint there is only for registered users, and records are scoped to the currently signed-in user.\n\n### PoC\nPreconditions\n- No authentication required\n- No cookies or session tokens set\n\nTo reproduce this vulnerability simply perform the request shown below, replacing the number with an arbitrary value. \n\n**For the initial request the Guest Address id = 6 is used to obtain the information**\n\n**Request**\nGET `/addresses/6/edit`\n\n\u003cimg width=\"291\" height=\"454\" alt=\"IDOR Guest\" src=\"https://github.com/user-attachments/assets/d21d01a2-8fa5-4ab1-b9e2-6ee65bd6b5a2\" /\u003e\n\nRepeat the request and check the response, in this example using Guest Address id = 2.\n\n**Request**\nGET `/addresses/2/edit`\n\n[\u003cimg width=\"360\" height=\"519\" alt=\"IDOR Guest Address ID 2\" src=\"https://github.com/user-attachments/assets/1ce35990-3d11-4f47-9bba-266b5361313c\" /\u003e\n](url)\n\n### Impact\nAn unauthenticated attacker can:\n\n- Enumerate and retrieve guest address information (Addresses associated with User accounts are NOT affected)\n- Access personally identifiable information (PII) such as:\n- Full names\n- Physical addresses\n- Phone numbers (if present)\n\nThis vulnerability could lead to:\n\n- Privacy violations\n- Regulatory compliance issues (e.g., GDPR)\n- Loss of user trust",
"id": "GHSA-3ghg-3787-w2xr",
"modified": "2026-01-11T14:56:25Z",
"published": "2026-01-08T21:28:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/spree/spree/security/advisories/GHSA-3ghg-3787-w2xr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22589"
},
{
"type": "WEB",
"url": "https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795"
},
{
"type": "WEB",
"url": "https://github.com/spree/spree/commit/4c2bd62326fba0d846fd9e4bad2c62433829b3ad"
},
{
"type": "WEB",
"url": "https://github.com/spree/spree/commit/d051925778f24436b62fa8e4a6b842c72ca80a67"
},
{
"type": "WEB",
"url": "https://github.com/spree/spree/commit/e1cff4605eb15472904602aebaf8f2d04852d6ad"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_core/CVE-2026-22589.yml"
},
{
"type": "PACKAGE",
"url": "https://github.com/spree/spree"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Spree API has Unauthenticated IDOR - Guest Address"
}
GHSA-3GJ6-5JX3-784R
Vulnerability from github – Published: 2024-09-04 09:30 – Updated: 2024-09-04 09:30The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.8 via the duplicate_post function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate posts written by other authors including admins. This includes the ability to duplicate password-protected posts, which reveals their contents.
{
"affected": [],
"aliases": [
"CVE-2024-8123"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T07:15:05Z",
"severity": "MODERATE"
},
"details": "The The Ultimate WordPress Toolkit \u2013 WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.8 via the duplicate_post function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate posts written by other authors including admins. This includes the ability to duplicate password-protected posts, which reveals their contents.",
"id": "GHSA-3gj6-5jx3-784r",
"modified": "2024-09-04T09:30:45Z",
"published": "2024-09-04T09:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8123"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wpextended/trunk/includes/modules/core_extensions/wpext_duplicator/wpext_duplicator.php#L48"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3145430%40wpextended%2Ftrunk\u0026old=3134345%40wpextended%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e421fb-4839-4e2d-911f-e2fa8c756744?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3GJH-JVM6-6PFG
Vulnerability from github – Published: 2026-04-20 18:31 – Updated: 2026-04-20 18:31A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles. The issue is triggered by modifying a parameter within requests sent to the /nasapi endpoint.
{
"affected": [],
"aliases": [
"CVE-2025-66954"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-20T17:16:29Z",
"severity": "MODERATE"
},
"details": "A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles. The issue is triggered by modifying a parameter within requests sent to the /nasapi endpoint.",
"id": "GHSA-3gjh-jvm6-6pfg",
"modified": "2026-04-20T18:31:49Z",
"published": "2026-04-20T18:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66954"
},
{
"type": "WEB",
"url": "https://github.com/DBmonster19/CVE-2025-66954"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3GQH-C39X-HVHH
Vulnerability from github – Published: 2024-08-19 00:31 – Updated: 2024-08-19 00:31Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.
{
"affected": [],
"aliases": [
"CVE-2024-43322"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-18T22:15:11Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.",
"id": "GHSA-3gqh-c39x-hvhh",
"modified": "2024-08-19T00:31:09Z",
"published": "2024-08-19T00:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43322"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/zephyr-project-manager/wordpress-zephyr-project-manager-plugin-3-3-100-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-3GWJ-2MCQ-R22X
Vulnerability from github – Published: 2026-05-12 18:30 – Updated: 2026-05-13 18:30An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request.
{
"affected": [],
"aliases": [
"CVE-2023-30059"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T16:16:12Z",
"severity": "MODERATE"
},
"details": "An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request.",
"id": "GHSA-3gwj-2mcq-r22x",
"modified": "2026-05-13T18:30:40Z",
"published": "2026-05-12T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30059"
},
{
"type": "WEB",
"url": "https://github.com/yueslly/MKAUTH-IDOR"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HG3-468C-H77G
Vulnerability from github – Published: 2026-10-16 18:34 – Updated: 2026-10-16 18:34O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.
{
"affected": [],
"aliases": [
"CVE-2026-111620"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T18:17:41Z",
"severity": "MODERATE"
},
"details": "O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users\u0027 processes.",
"id": "GHSA-3hg3-468c-h77g",
"modified": "2026-10-16T18:34:43Z",
"published": "2026-10-16T18:34:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111620"
},
{
"type": "WEB",
"url": "https://github.com/o2oa/o2oa"
},
{
"type": "WEB",
"url": "https://github.com/o2oa/o2oa/blob/10.0.2-ce/o2server/x_processplatform_assemble_surface/src/main/java/com/x/processplatform/assemble/surface/jaxrs/attachment/ActionDownloadWithWork.java#L44-L95"
},
{
"type": "WEB",
"url": "https://github.com/o2oa/o2oa/blob/10.0.2-ce/o2server/x_processplatform_assemble_surface/src/main/java/com/x/processplatform/assemble/surface/jaxrs/attachment/ActionDownloadWithWorkStream.java#L45-L64"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/o2oa-processplatform-attachment-download-work-cross-work-idor"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/o2oa-through-10.0.2-ce-cross-work-attachment-read-via-attachment-download-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3HGV-JR5J-CG9X
Vulnerability from github – Published: 2026-08-19 19:32 – Updated: 2026-08-19 19:32Impact
An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application.
Steps to Reproduce:
- Log in as a restricted user.
- Send a GET request to /api/v1/users/{target_id}/eulas (where target_id belongs to a restricted/denied user).
- Observe the response leaks the secret EULA filename (e.g., eula-xxx.pdf).
- Attempt to access this file via the main route: GET /stored-eula-file/{filename} (This will correctly return 403 Forbidden).
- Now, access the file via the vulnerable profile route: GET /account/stored-eula-file/{filename}.
- Observe that the server returns a 200 OK and successfully downloads the target user's secret EULA file.
Patches
Fixed in https://github.com/grokability/snipe-it/commit/f15d78621b003be30ac114ba68626683894935ef
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55694"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-19T19:32:18Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nAn attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application.\n\n### Steps to Reproduce:\n1. Log in as a restricted user.\n2. Send a GET request to /api/v1/users/{target_id}/eulas (where target_id belongs to a restricted/denied user).\n3. Observe the response leaks the secret EULA filename (e.g., eula-xxx.pdf).\n4. Attempt to access this file via the main route: GET /stored-eula-file/{filename} (This will correctly return 403 Forbidden).\n5. Now, access the file via the vulnerable profile route: GET /account/stored-eula-file/{filename}.\n6. Observe that the server returns a 200 OK and successfully downloads the target user\u0027s secret EULA file.\n\n### Patches\nFixed in https://github.com/grokability/snipe-it/commit/f15d78621b003be30ac114ba68626683894935ef",
"id": "GHSA-3hgv-jr5j-cg9x",
"modified": "2026-08-19T19:32:18Z",
"published": "2026-08-19T19:32:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-3hgv-jr5j-cg9x"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/commit/f15d78621b003be30ac114ba68626683894935ef"
},
{
"type": "PACKAGE",
"url": "https://github.com/grokability/snipe-it"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover"
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.