CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5459 vulnerabilities reference this CWE, most recent first.
GHSA-6PJC-995P-MH58
Vulnerability from github – Published: 2026-02-23 18:32 – Updated: 2026-02-23 18:32An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.
{
"affected": [],
"aliases": [
"CVE-2026-2697"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-23T16:29:37Z",
"severity": "MODERATE"
},
"details": "An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the \u0027owner\u0027 parameter.",
"id": "GHSA-6pjc-995p-mh58",
"modified": "2026-02-23T18:32:02Z",
"published": "2026-02-23T18:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2697"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2026-07"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6PP4-6Q7M-6492
Vulnerability from github – Published: 2026-10-07 09:32 – Updated: 2026-10-07 12:31The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
{
"affected": [],
"aliases": [
"CVE-2026-104651"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-07T07:16:57Z",
"severity": "MODERATE"
},
"details": "The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.",
"id": "GHSA-6pp4-6q7m-6492",
"modified": "2026-10-07T12:31:56Z",
"published": "2026-10-07T09:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104651"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/be0e4e18-0bd7-455a-93f6-8f4a7f18b7e1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6PP9-X443-R8XW
Vulnerability from github – Published: 2026-07-31 09:31 – Updated: 2026-07-31 18:32The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
{
"affected": [],
"aliases": [
"CVE-2026-8155"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-31T07:16:28Z",
"severity": "MODERATE"
},
"details": "The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users\u0027 private messages.",
"id": "GHSA-6pp9-x443-r8xw",
"modified": "2026-07-31T18:32:17Z",
"published": "2026-07-31T09:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8155"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/b7dd9cbf-b46b-49ee-84a0-6b054676fccb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6PRJ-5R8W-3X38
Vulnerability from github – Published: 2022-10-18 19:00 – Updated: 2024-08-02 21:31The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r= HTTP GET parameter. This leads to an Insecure Direct Object References (IDOR) vulnerability which allows attackers to access the application source code.
{
"affected": [],
"aliases": [
"CVE-2022-41479"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-18T14:15:00Z",
"severity": "HIGH"
},
"details": "The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects in the /DXR.axd?r= HTTP GET parameter. This leads to an Insecure Direct Object References (IDOR) vulnerability which allows attackers to access the application source code.",
"id": "GHSA-6prj-5r8w-3x38",
"modified": "2024-08-02T21:31:32Z",
"published": "2022-10-18T19:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41479"
},
{
"type": "WEB",
"url": "https://github.com/IthacaLabs/DevExpress/tree/main/ASP.NET_Web_Forms_Build_19.2.3"
},
{
"type": "WEB",
"url": "https://supportcenter.devexpress.com/ticket/details/t1171808/penetration-test-idor-source-code-cve-2022-41479"
},
{
"type": "WEB",
"url": "https://supportcenter.devexpress.com/ticket/details/t190349/false-positive-vulnerabilities-known-alerts-detected-by-various-security-scanners-and"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6Q79-HWRV-JC95
Vulnerability from github – Published: 2026-03-19 06:30 – Updated: 2026-04-28 21:35Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple Security Pro: from n/a through 9.5.4.0.
{
"affected": [],
"aliases": [
"CVE-2026-27397"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-19T06:16:25Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple Security Pro: from n/a through 9.5.4.0.",
"id": "GHSA-6q79-hwrv-jc95",
"modified": "2026-04-28T21:35:57Z",
"published": "2026-03-19T06:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27397"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/really-simple-ssl-pro/vulnerability/wordpress-really-simple-security-pro-plugin-9-5-3-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-6QM2-C6M9-24VC
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-05-24 19:15Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5).
{
"affected": [],
"aliases": [
"CVE-2021-36874"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-27T16:15:00Z",
"severity": "HIGH"
},
"details": "Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions \u003c= 2.0.5).",
"id": "GHSA-6qm2-c6m9-24vc",
"modified": "2022-05-24T19:15:48Z",
"published": "2022-05-24T19:15:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36874"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/ulisting/wordpress-ulisting-plugin-2-0-5-authenticated-insecure-direct-object-references-idor-vulnerability"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/ulisting/#developers"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6QRR-HHGQ-84G9
Vulnerability from github – Published: 2026-10-05 18:34 – Updated: 2026-10-14 21:33Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.
{
"affected": [],
"aliases": [
"CVE-2026-102775"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-05T16:17:04Z",
"severity": "HIGH"
},
"details": "Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart\u0027s order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only \u2014 they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer\u0027s digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.",
"id": "GHSA-6qrr-hhgq-84g9",
"modified": "2026-10-14T21:33:05Z",
"published": "2026-10-05T18:34:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102775"
},
{
"type": "WEB",
"url": "https://www.phoca.cz"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6QX6-FPJX-PG68
Vulnerability from github – Published: 2026-10-10 15:30 – Updated: 2026-10-10 15:30Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.
{
"affected": [],
"aliases": [
"CVE-2026-108164"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-10T14:16:37Z",
"severity": "HIGH"
},
"details": "Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users\u0027 private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.",
"id": "GHSA-6qx6-fpjx-pg68",
"modified": "2026-10-10T15:30:22Z",
"published": "2026-10-10T15:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108164"
},
{
"type": "WEB",
"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/issues/2641"
},
{
"type": "WEB",
"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/2e9733d8eaafccdaef3d9b498348c8332e51f48b"
},
{
"type": "WEB",
"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork"
},
{
"type": "WEB",
"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/blob/48b53f5b95488187715b2d5b5ae46a993267f83d/components/OssnMessages/ossn_com.php#L149-L156"
},
{
"type": "WEB",
"url": "https://hackmd.io/@leediay/ossn-idor-message-attachment"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/open-source-social-network-ossn-through-10.1-idor-via-message-attachment-route"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6QXC-JV43-6QG3
Vulnerability from github – Published: 2023-07-04 09:30 – Updated: 2024-04-04 05:23The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
{
"affected": [],
"aliases": [
"CVE-2023-3133"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-04T08:15:10Z",
"severity": "HIGH"
},
"details": "The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.",
"id": "GHSA-6qxc-jv43-6qg3",
"modified": "2024-04-04T05:23:10Z",
"published": "2023-07-04T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3133"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/2.2.0/classes/RestAPI.php#L253"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/tutor"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/3b6969a7-5cbc-4e16-8f27-5dde481237f5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6R37-32VJ-MJWV
Vulnerability from github – Published: 2026-09-16 15:31 – Updated: 2026-09-16 15:31Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the edit_posts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs.
{
"affected": [],
"aliases": [
"CVE-2026-89029"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T14:17:13Z",
"severity": "MODERATE"
},
"details": "Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the edit_posts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs.",
"id": "GHSA-6r37-32vj-mjwv",
"modified": "2026-09-16T15:31:10Z",
"published": "2026-09-16T15:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89029"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/blog2social/#developers"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/blog2social-wordpress-plugin-user-enumeration-via-ajax-handler"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.