CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5490 vulnerabilities reference this CWE, most recent first.
GHSA-5XQQ-W6XH-VWC6
Vulnerability from github – Published: 2026-09-29 21:33 – Updated: 2026-09-30 18:33metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session store (getSession in session-lifetime-manager.ts) is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the per-endpoint authorization middleware validates only the URL endpoint's owner, never the session. An attacker who supplies another tenant's session id " obtained without authentication from GET /metamcp/health/sessions, which discloses active session IDs and namespace UUIDs " can list and execute the victim tenant's private MCP tools and exfiltrate their data using the victim's forwarded credentials.
{
"affected": [],
"aliases": [
"CVE-2026-79537"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-29T20:17:27Z",
"severity": "CRITICAL"
},
"details": "metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session store (getSession in session-lifetime-manager.ts) is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the per-endpoint authorization middleware validates only the URL endpoint\u0027s owner, never the session. An attacker who supplies another tenant\u0027s session id \" obtained without authentication from GET /metamcp/health/sessions, which discloses active session IDs and namespace UUIDs \" can list and execute the victim tenant\u0027s private MCP tools and exfiltrate their data using the victim\u0027s forwarded credentials.",
"id": "GHSA-5xqq-w6xh-vwc6",
"modified": "2026-09-30T18:33:18Z",
"published": "2026-09-29T21:33:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79537"
},
{
"type": "WEB",
"url": "https://github.com/metatool-ai/metamcp"
},
{
"type": "WEB",
"url": "https://www.traceforce.ai/security-advisories/cve-2026-79537"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5XWG-Q2HM-F263
Vulnerability from github – Published: 2026-07-20 21:31 – Updated: 2026-08-14 15:32VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.
{
"affected": [],
"aliases": [
"CVE-2026-13381"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-20T21:16:46Z",
"severity": "HIGH"
},
"details": "VSee Clinic 7.1.26 and API\u00a01.3.0\u00a0contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the \u0027remark\u0027 request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.",
"id": "GHSA-5xwg-q2hm-f263",
"modified": "2026-08-14T15:32:43Z",
"published": "2026-07-20T21:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13381"
},
{
"type": "WEB",
"url": "https://labs.sra.io/posts/vseeclinic"
},
{
"type": "WEB",
"url": "https://vsee.com/clinic"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-623V-MJRC-8WR7
Vulnerability from github – Published: 2026-08-25 15:32 – Updated: 2026-08-25 15:32Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.
{
"affected": [],
"aliases": [
"CVE-2026-78581"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T13:19:31Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user\u0027s AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.",
"id": "GHSA-623v-mjrc-8wr7",
"modified": "2026-08-25T15:32:58Z",
"published": "2026-08-25T15:32:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78581"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/kibana-8-16-3-8-17-2-security-update-esa-2026-51/387446"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6286-H9RV-4J7M
Vulnerability from github – Published: 2026-10-13 21:36 – Updated: 2026-10-13 21:36Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
{
"affected": [],
"aliases": [
"CVE-2026-85873"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T19:21:14Z",
"severity": "MODERATE"
},
"details": "Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.",
"id": "GHSA-6286-h9rv-4j7m",
"modified": "2026-10-13T21:36:11Z",
"published": "2026-10-13T21:36:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85873"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85873"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6288-WF2G-3FWM
Vulnerability from github – Published: 2026-05-05 09:31 – Updated: 2026-05-05 09:31The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing object-level authorization checks in the /wp-json/generateblocks/v1/dynamic-tag-replacements REST endpoint. The endpoint only verifies that the user has the edit_posts capability but does not verify the user has permission to access the specific post or its associated data referenced by attacker-controlled id parameters in dynamic tag content. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive information from arbitrary posts including author email addresses and non-protected post meta values by crafting dynamic tag payloads such as {{post_meta id:|key:}} and {{post_title id:|link:author_email}}.
{
"affected": [],
"aliases": [
"CVE-2026-3454"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-05T07:16:00Z",
"severity": "MODERATE"
},
"details": "The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing object-level authorization checks in the /wp-json/generateblocks/v1/dynamic-tag-replacements REST endpoint. The endpoint only verifies that the user has the edit_posts capability but does not verify the user has permission to access the specific post or its associated data referenced by attacker-controlled id parameters in dynamic tag content. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive information from arbitrary posts including author email addresses and non-protected post meta values by crafting dynamic tag payloads such as {{post_meta id:\u003ctarget\u003e|key:\u003cmeta_key\u003e}} and {{post_title id:\u003ctarget\u003e|link:author_email}}.",
"id": "GHSA-6288-wf2g-3fwm",
"modified": "2026-05-05T09:31:55Z",
"published": "2026-05-05T09:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3454"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/class-meta-handler.php#L335"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/dynamic-tags/class-dynamic-tag-callbacks.php#L364"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/dynamic-tags/class-dynamic-tag-callbacks.php#L64"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/dynamic-tags/class-dynamic-tags.php#L392"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/dynamic-tags/class-dynamic-tags.php#L424"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/generateblocks/tags/2.2.0/includes/dynamic-tags/class-dynamic-tags.php#L501"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3495827%40generateblocks%2Ftrunk\u0026old=3415721%40generateblocks%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0297d524-e016-4f8d-920c-d58c62edb2a0?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-62CG-2VPQ-H2G2
Vulnerability from github – Published: 2026-10-28 03:31 – Updated: 2026-10-28 03:31nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
{
"affected": [],
"aliases": [
"CVE-2026-117605"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-28T03:17:11Z",
"severity": "MODERATE"
},
"details": "nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor\u0027s product id as model.ProductId to inject their products into the victim\u0027s related-products, cross-sell and grouped-product listings.",
"id": "GHSA-62cg-2vpq-h2g2",
"modified": "2026-10-28T03:31:50Z",
"published": "2026-10-28T03:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117605"
},
{
"type": "WEB",
"url": "https://github.com/nopSolutions/nopCommerce/issues/8417"
},
{
"type": "WEB",
"url": "https://github.com/nopSolutions/nopCommerce/commit/fbdbe18d43b42b7e269f7118cfc9533349ed2dc0"
},
{
"type": "WEB",
"url": "https://github.com/nopSolutions/nopCommerce"
},
{
"type": "WEB",
"url": "https://github.com/nopSolutions/nopCommerce/blob/918444773367deb734b93d3ad80e17325d6c147a/src/Presentation/Nop.Web/Areas/Admin/Controllers/ProductController.cs#L1655-L1679"
},
{
"type": "WEB",
"url": "https://github.com/nopSolutions/nopCommerce/releases/tag/release-5.00.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nopcommerce-before-5.00.0-missing-authorization-via-admin-productcontroller-add-popup-handlers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-62F6-6F4G-PR5M
Vulnerability from github – Published: 2026-10-14 21:33 – Updated: 2026-10-14 21:33Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.
{
"affected": [],
"aliases": [
"CVE-2026-110774"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T19:17:13Z",
"severity": "MODERATE"
},
"details": "Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users\u0027 private attachments due to a flawed owner check. Attackers can supply another user\u0027s stored filename, following a basename plus millisecond-timestamp pattern, to download private, non-shared attachments.",
"id": "GHSA-62f6-6f4g-pr5m",
"modified": "2026-10-14T21:33:45Z",
"published": "2026-10-14T21:33:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110774"
},
{
"type": "WEB",
"url": "https://github.com/blinkospace/blinko"
},
{
"type": "WEB",
"url": "https://github.com/blinkospace/blinko/blob/178e4b3538a21823a50ac2481e653d56cb1ffa86/server/routerExpress/file/file.ts#L148"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/blinko-attachment-accountid-idor"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/blinko-through-1.8.8-private-attachment-read-via-api-file-route"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-62GQ-FGJ3-92V6
Vulnerability from github – Published: 2023-02-27 18:32 – Updated: 2023-03-03 18:30The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing
{
"affected": [],
"aliases": [
"CVE-2022-4550"
],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-27T16:15:00Z",
"severity": "HIGH"
},
"details": "The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing",
"id": "GHSA-62gq-fgj3-92v6",
"modified": "2023-03-03T18:30:26Z",
"published": "2023-02-27T18:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4550"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/a1179959-2044-479f-a5ca-3c9ffc46d00e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-62M2-79CV-F29W
Vulnerability from github – Published: 2025-11-06 18:32 – Updated: 2026-01-20 15:31Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9.
{
"affected": [],
"aliases": [
"CVE-2025-58627"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-06T16:15:59Z",
"severity": "CRITICAL"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through \u003c 2.0.9.",
"id": "GHSA-62m2-79cv-f29w",
"modified": "2026-01-20T15:31:48Z",
"published": "2025-11-06T18:32:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58627"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-9-insecure-direct-object-references-idor-vulnerability"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-62Q8-JG47-5WPW
Vulnerability from github – Published: 2026-06-02 15:32 – Updated: 2026-06-02 15:32CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.
{
"affected": [],
"aliases": [
"CVE-2026-7201"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-02T14:17:14Z",
"severity": "HIGH"
},
"details": "CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.",
"id": "GHSA-62q8-jg47-5wpw",
"modified": "2026-06-02T15:32:13Z",
"published": "2026-06-02T15:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7201"
},
{
"type": "WEB",
"url": "https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.