CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5491 vulnerabilities reference this CWE, most recent first.
GHSA-5PGF-H923-M958
Vulnerability from github – Published: 2026-03-24 16:59 – Updated: 2026-03-25 21:00Summary
An unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes.
The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL.
Details
Root cause: - Anonymous endpoint accepts user-controlled asset reference. - It creates and returns a transform URL for that asset without checking access rights. - If the transform output is reachable, guest users can read content derived from private assets.
Who is impacted:
- Installations where private source assets can be transformed and transform URLs are reachable.
Security consequence:
- Anonymous users can obtain content derived from private assets without authentication.
Resources
https://github.com/craftcms/cms/commit/7290d91639e
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.9.13"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0-RC1"
},
{
"fixed": "5.9.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.17.7"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-RC1"
},
{
"fixed": "4.17.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33160"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-24T16:59:58Z",
"nvd_published_at": "2026-03-24T18:16:10Z",
"severity": "LOW"
},
"details": "### Summary\n\nAn unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes.\n\nThe endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL.\n\n### Details\n\nRoot cause:\n- Anonymous endpoint accepts user-controlled asset reference.\n- It creates and returns a transform URL for that asset without checking access rights.\n- If the transform output is reachable, guest users can read content derived from private assets.\n\nWho is impacted:\n\n- Installations where private source assets can be transformed and transform URLs are reachable.\n\nSecurity consequence:\n\n - Anonymous users can obtain content derived from private assets without authentication.\n\n### Resources\n\nhttps://github.com/craftcms/cms/commit/7290d91639e",
"id": "GHSA-5pgf-h923-m958",
"modified": "2026-03-25T21:00:12Z",
"published": "2026-03-24T16:59:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-5pgf-h923-m958"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33160"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/7290d91639e5e3a4f7e221dfbef95c9b77331860"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftcms/cms"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/releases/tag/4.17.8"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/releases/tag/5.9.14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Craft CMS may expose private assets through anonymous \"generate transform\" calls via transform URL"
}
GHSA-5PPV-GW49-FRMX
Vulnerability from github – Published: 2026-03-11 06:31 – Updated: 2026-03-11 15:31The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register).
{
"affected": [],
"aliases": [
"CVE-2026-1753"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-11T06:17:13Z",
"severity": "MODERATE"
},
"details": "The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register).",
"id": "GHSA-5ppv-gw49-frmx",
"modified": "2026-03-11T15:31:51Z",
"published": "2026-03-11T06:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1753"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/c42dbab9-b729-4748-88e5-0bd2f6d66e3d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5PV8-92G5-57VM
Vulnerability from github – Published: 2026-10-11 15:31 – Updated: 2026-10-13 15:31UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the server's tools using the victim's upstream authentication.
{
"affected": [],
"aliases": [
"CVE-2026-108856"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-11T14:17:05Z",
"severity": "LOW"
},
"details": "UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users\u0027 MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim\u0027s MCP server UUID with appType mcpserver can open MCP sessions and invoke the server\u0027s tools using the victim\u0027s upstream authentication.",
"id": "GHSA-5pv8-92g5-57vm",
"modified": "2026-10-13T15:31:51Z",
"published": "2026-10-11T15:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108856"
},
{
"type": "WEB",
"url": "https://github.com/UnicomAI/wanwu"
},
{
"type": "WEB",
"url": "https://github.com/UnicomAI/wanwu/blob/v0.6.5/internal/app-service/client/orm/app_key.go#L37-L49"
},
{
"type": "WEB",
"url": "https://github.com/UnicomAI/wanwu/blob/v0.6.5/internal/bff-service/server/http/middleware/auth_openapi.go#L46-L70"
},
{
"type": "WEB",
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-108856-unicomai-wanwu-mcp-key-arbitrary-resource"
},
{
"type": "WEB",
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/unicomai-wanwu-mcp-key-arbitrary-resource"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/unicomai-wanwu-through-0.6.5-authorization-bypass-via-v1-appspace-app-key-appkey-minting"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5PVQ-7P6F-H4J3
Vulnerability from github – Published: 2026-10-22 12:31 – Updated: 2026-10-22 12:31Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.
{
"affected": [],
"aliases": [
"CVE-2026-115334"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-22T11:17:52Z",
"severity": "HIGH"
},
"details": "Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization\u0027s UUID can send a POST request to /app/switch_organization/ to access that tenant\u0027s data and billing configuration.",
"id": "GHSA-5pvq-7p6f-h4j3",
"modified": "2026-10-22T12:31:18Z",
"published": "2026-10-22T12:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115334"
},
{
"type": "WEB",
"url": "https://github.com/uselotus/lotus"
},
{
"type": "WEB",
"url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/views/views.py#L326-L340"
},
{
"type": "WEB",
"url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-authorization-bypass-via-switch-organization-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5PWX-2RRR-XCVM
Vulnerability from github – Published: 2024-01-11 09:30 – Updated: 2026-04-08 21:32The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site.
{
"affected": [],
"aliases": [
"CVE-2023-6506"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-732"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-11T07:15:08Z",
"severity": "MODERATE"
},
"details": "The WP 2FA \u2013 Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site.",
"id": "GHSA-5pwx-2rrr-xcvm",
"modified": "2026-04-08T21:32:09Z",
"published": "2024-01-11T09:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6506"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-2fa/trunk/includes/classes/Admin/class-setup-wizard.php?rev=2940688#L606"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3009922%40wp-2fa\u0026new=3009922%40wp-2fa\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/caff9be6-4161-47a0-ba47-6c8fc0c4ab40?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5Q4Q-834J-G8G4
Vulnerability from github – Published: 2026-06-30 16:44 – Updated: 2026-06-30 16:44Summary
The checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because bundled server extensions prioritize these user-supplied properties over administrator-defined configurations, a regular user can override hosting plans and resource limits at checkout without special privileges.
Technical Details
The Checkout Livewire component (app/Livewire/Products/Checkout.php) exposes the $checkoutConfig property to URL query parameters via the #[Url] attribute (aliased as config).
When processing this input:
1. Validation rules are dynamically generated only for keys explicitly defined by an extension's getCheckoutConfig() method. Any undefined keys injected into the query parameter bypass validation entirely.
2. The cart component (app/Livewire/Cart.php) stores all keys from checkout_config directly into the database without sanitation:
foreach ($item->checkout_config as $key => $value) {
$service->properties()->updateOrCreate(['key' => $key], ['value' => $value]);
}
- During server provisioning, app/Helpers/ExtensionHelper.php retrieves these stored properties and passes them to the extension's createServer() method.
Because of how individual server extensions handle these properties, user-injected data overrides intended administrator settings.
Impact
This is a business logic flaw that allows remote, authenticated users to manipulate server provisioning parameters.
Depending on the active extension, this leads to unauthorized overrides of core resource limits (such as CPU, RAM, storage, or package tiers). No administrative privileges are required to exploit this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "paymenter/paymenter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47198"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-30T16:44:31Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nThe checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because bundled server extensions prioritize these user-supplied properties over administrator-defined configurations, a regular user can override hosting plans and resource limits at checkout without special privileges.\n\n### Technical Details\nThe `Checkout` Livewire component (`app/Livewire/Products/Checkout.php`) exposes the `$checkoutConfig` property to URL query parameters via the `#[Url]` attribute (aliased as `config`). \n\nWhen processing this input:\n1. Validation rules are dynamically generated *only* for keys explicitly defined by an extension\u0027s `getCheckoutConfig()` method. Any undefined keys injected into the query parameter bypass validation entirely.\n2. The cart component (`app/Livewire/Cart.php`) stores all keys from `checkout_config` directly into the database without sanitation:\n```php\n foreach ($item-\u003echeckout_config as $key =\u003e $value) {\n $service-\u003eproperties()-\u003eupdateOrCreate([\u0027key\u0027 =\u003e $key], [\u0027value\u0027 =\u003e $value]);\n }\n```\n3. During server provisioning, app/Helpers/ExtensionHelper.php retrieves these stored properties and passes them to the extension\u0027s createServer() method.\n\nBecause of how individual server extensions handle these properties, user-injected data overrides intended administrator settings.\n\n### Impact\nThis is a business logic flaw that allows remote, authenticated users to manipulate server provisioning parameters.\n\nDepending on the active extension, this leads to unauthorized overrides of core resource limits (such as CPU, RAM, storage, or package tiers). No administrative privileges are required to exploit this vulnerability.",
"id": "GHSA-5q4q-834j-g8g4",
"modified": "2026-06-30T16:44:31Z",
"published": "2026-06-30T16:44:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5q4q-834j-g8g4"
},
{
"type": "PACKAGE",
"url": "https://github.com/Paymenter/Paymenter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Paymenter has URL parameter injection that bypasses paid plan limits at checkout"
}
GHSA-5Q4V-58R2-WWVG
Vulnerability from github – Published: 2026-10-20 12:31 – Updated: 2026-10-20 12:31OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.
{
"affected": [],
"aliases": [
"CVE-2026-113349"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-20T11:17:19Z",
"severity": "MODERATE"
},
"details": "OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users\u0027 calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user\u0027s events, including non-public ones restricted to their owner.",
"id": "GHSA-5q4v-58r2-wwvg",
"modified": "2026-10-20T12:31:34Z",
"published": "2026-10-20T12:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113349"
},
{
"type": "WEB",
"url": "https://github.com/opencats/OpenCATS/issues/720"
},
{
"type": "WEB",
"url": "https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd"
},
{
"type": "WEB",
"url": "https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/lib/Calendar.php#L83-L150"
},
{
"type": "WEB",
"url": "https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/calendar/CalendarUI.php#L555-L585"
},
{
"type": "WEB",
"url": "https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/calendar/CalendarUI.php#L690-L712"
},
{
"type": "WEB",
"url": "https://github.com/opencats/OpenCATS/releases/tag/v0.10.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-in-calendar-editevent-deleteevent"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5Q68-9MM8-Q9VM
Vulnerability from github – Published: 2022-08-02 00:00 – Updated: 2022-08-05 00:00The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
{
"affected": [],
"aliases": [
"CVE-2022-1600"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-01T13:15:00Z",
"severity": "MODERATE"
},
"details": "The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor\u0027s IP from certain HTTP headers over PHP\u0027s REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.",
"id": "GHSA-5q68-9mm8-q9vm",
"modified": "2022-08-05T00:00:26Z",
"published": "2022-08-02T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1600"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/2b7445fd-0992-47cd-9a48-f5f18d8171f7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5QPV-3MXM-5V8R
Vulnerability from github – Published: 2026-06-26 15:32 – Updated: 2026-06-26 15:32Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.
{
"affected": [],
"aliases": [
"CVE-2026-57646"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-26T15:16:52Z",
"severity": "MODERATE"
},
"details": "Subscriber Insecure Direct Object References (IDOR) in Majestic Support \u003c= 1.1.7 versions.",
"id": "GHSA-5qpv-3mxm-5v8r",
"modified": "2026-06-26T15:32:18Z",
"published": "2026-06-26T15:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57646"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/majestic-support/vulnerability/wordpress-majestic-support-plugin-1-1-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5QV2-JC6Q-28VV
Vulnerability from github – Published: 2022-05-13 01:43 – Updated: 2022-05-13 01:43In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description.
{
"affected": [],
"aliases": [
"CVE-2017-15199"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-11T01:32:00Z",
"severity": "MODERATE"
},
"details": "In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description.",
"id": "GHSA-5qv2-jc6q-28vv",
"modified": "2022-05-13T01:43:39Z",
"published": "2022-05-13T01:43:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15199"
},
{
"type": "WEB",
"url": "https://github.com/kanboard/kanboard/commit/074f6c104f3e49401ef0065540338fc2d4be79f0"
},
{
"type": "WEB",
"url": "https://github.com/kanboard/kanboard/commit/3e0f14ae2b0b5a44bd038a472f17eac75f538524"
},
{
"type": "WEB",
"url": "https://kanboard.net/news/version-1.0.47"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2017/10/04/9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.