CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5459 vulnerabilities reference this CWE, most recent first.
GHSA-6VQH-42FF-MF97
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-04-01 18:36Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.5.2 before 10.7.2.
{
"affected": [],
"aliases": [
"CVE-2026-2414"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T17:16:57Z",
"severity": "MODERATE"
},
"details": "Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.5.2 before 10.7.2.",
"id": "GHSA-6vqh-42ff-mf97",
"modified": "2026-04-01T18:36:32Z",
"published": "2026-03-25T18:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2414"
},
{
"type": "WEB",
"url": "https://www.hypr.com/trust-center/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6VRQ-VFH4-V7V2
Vulnerability from github – Published: 2026-10-30 15:34 – Updated: 2026-10-30 15:34FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
{
"affected": [],
"aliases": [
"CVE-2026-119657"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-30T15:16:49Z",
"severity": "LOW"
},
"details": "FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries\u0027 folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library\u0027s appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.",
"id": "GHSA-6vrq-vfh4-v7v2",
"modified": "2026-10-30T15:34:39Z",
"published": "2026-10-30T15:34:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119657"
},
{
"type": "WEB",
"url": "https://github.com/zyx0814/FilePress/issues/76"
},
{
"type": "WEB",
"url": "https://github.com/zyx0814/FilePress"
},
{
"type": "WEB",
"url": "https://github.com/zyx0814/FilePress/blob/3.0.1/core/class/table/table_pichome_vappmember.php#L56-L64"
},
{
"type": "WEB",
"url": "https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library.php#L9"
},
{
"type": "WEB",
"url": "https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/folder.php#L6-L50"
},
{
"type": "WEB",
"url": "https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/rightdata.php#L6-L30"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-missing-per-library-authorization-idor"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/filepress-through-3.0.1-missing-authorization-in-pichome-library-folder-operations"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6W2R-58CQ-54Q2
Vulnerability from github – Published: 2023-10-19 12:30 – Updated: 2024-04-04 08:47A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero.
{
"affected": [],
"aliases": [
"CVE-2022-24400"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-807"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-19T10:15:08Z",
"severity": "MODERATE"
},
"details": "A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero.",
"id": "GHSA-6w2r-58cq-54q2",
"modified": "2024-04-04T08:47:11Z",
"published": "2023-10-19T12:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24400"
},
{
"type": "WEB",
"url": "https://tetraburst.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6W2R-GP8J-3HJR
Vulnerability from github – Published: 2026-09-16 06:31 – Updated: 2026-09-17 15:31The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers.
{
"affected": [],
"aliases": [
"CVE-2026-88910"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T06:16:35Z",
"severity": "MODERATE"
},
"details": "The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers.",
"id": "GHSA-6w2r-gp8j-3hjr",
"modified": "2026-09-17T15:31:55Z",
"published": "2026-09-16T06:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88910"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/96119ba5-4dcd-4aff-adf9-83f058c3dc6d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6W8J-G3MG-6QW4
Vulnerability from github – Published: 2026-07-27 18:31 – Updated: 2026-07-27 21:31Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.
This issue affects :
- Devolutions Server 2026.2.4.0 through 2026.2.12.0
- Devolutions Server 2026.1.23.0 and earlier
{
"affected": [],
"aliases": [
"CVE-2026-17570"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-27T18:16:54Z",
"severity": "MODERATE"
},
"details": "Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.\n\nThis issue affects :\n\n * Devolutions Server 2026.2.4.0 through 2026.2.12.0\n * Devolutions Server 2026.1.23.0 and earlier",
"id": "GHSA-6w8j-g3mg-6qw4",
"modified": "2026-07-27T21:31:21Z",
"published": "2026-07-27T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17570"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2026-0026"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6W8V-V5W3-7X56
Vulnerability from github – Published: 2026-10-01 12:31 – Updated: 2026-10-01 12:31n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.
{
"affected": [],
"aliases": [
"CVE-2026-103246"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-01T11:17:17Z",
"severity": "HIGH"
},
"details": "n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification.",
"id": "GHSA-6w8v-v5w3-7x56",
"modified": "2026-10-01T12:31:15Z",
"published": "2026-10-01T12:31:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-9rhv-fhr8-7q5r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103246"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-2.39.6-and-2.40-x-before-2.40.1-credential-disclosure-via-node-tool-introspection"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6WFC-76CQ-VCFM
Vulnerability from github – Published: 2026-10-11 00:30 – Updated: 2026-10-11 00:30JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET /airag/video/listByUser endpoint and delete victims' Redis-stored video history entries one record per request.
{
"affected": [],
"aliases": [
"CVE-2026-108607"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-10T22:16:34Z",
"severity": "MODERATE"
},
"details": "JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users\u0027 AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET /airag/video/listByUser endpoint and delete victims\u0027 Redis-stored video history entries one record per request.",
"id": "GHSA-6wfc-76cq-vcfm",
"modified": "2026-10-11T00:30:51Z",
"published": "2026-10-11T00:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108607"
},
{
"type": "WEB",
"url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_video_record_delete.py"
},
{
"type": "WEB",
"url": "https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/video/controller/VideoGenerationController.java#L83-L90"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-idor-via-deletevideorecord-userid-parameter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6WHJ-7QMG-86QJ
Vulnerability from github – Published: 2026-02-02 17:31 – Updated: 2026-02-03 16:09Summary
An IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims' Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim's Khoj search index.
This attack requires knowing the user's UUID which can be leaked through shared conversations where an AI generated image is present.
Details
When users share conversations which contain AI generated images, the file path for the image is constructed using the user's UUID. Knowing this UUID, an attacker is able to intercept the OAuth callback for Notion and replace the state parameter with the other user's UUID and sync notion onto their account.
PoC
The vulnerable line of code exists in src/khoj/routers/notion.py on the callback endpoint.
@notion_router.get("/auth/callback")
async def notion_auth_callback(request: Request, background_tasks: BackgroundTasks):
code = request.query_params.get("code")
state = request.query_params.get("state") # <-- Attacker controlled
if not code or not state:
return Response("Missing code or state", status_code=400)
user: KhojUser = await aget_user_by_uuid(state) # <-- No verification!
await NotionConfig.objects.filter(user=user).adelete() # <-- Deletes victim's config
# ... OAuth token exchange ...
access_token = final_response.get("access_token")
await NotionConfig.objects.acreate(token=access_token, user=user) # <-- Stores attacker's token
To exploit is relatively easy. Once we know the victim's UUID, we simply initiate the Notion sync process on our own account and intercept the callback, replacing the state parameter with the victim's UUID.
Impact
Deletes user's existing Notion sync and replaces it with attacker-controlled Notion. Could allow for index poisoning. I'm not entirely sure what Khoj does with synced files but if it's being passed as context to an LLM then I can imagine there's potential here.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "khoj"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0.0b25.dev3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-69207"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-02T17:31:33Z",
"nvd_published_at": "2026-02-02T23:16:01Z",
"severity": "MODERATE"
},
"details": "### Summary\nAn IDOR in the Notion OAuth callback allows an attacker to hijack any user\u0027s Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID without verifying the OAuth flow was initiated by that user, allowing attackers to replace victims\u0027 Notion configurations with their own, resulting in data poisoning and unauthorized access to the victim\u0027s Khoj search index.\n\nThis attack requires knowing the user\u0027s UUID which can be leaked through shared conversations where an AI generated image is present.\n\n### Details\nWhen users share conversations which contain AI generated images, the file path for the image is constructed using the user\u0027s UUID. Knowing this UUID, an attacker is able to intercept the OAuth callback for Notion and replace the `state` parameter with the other user\u0027s UUID and sync notion onto their account.\n\n### PoC\n\nThe vulnerable line of code exists in `src/khoj/routers/notion.py` on the callback endpoint.\n```python\n@notion_router.get(\"/auth/callback\")\nasync def notion_auth_callback(request: Request, background_tasks: BackgroundTasks):\n code = request.query_params.get(\"code\")\n state = request.query_params.get(\"state\") # \u003c-- Attacker controlled\n if not code or not state:\n return Response(\"Missing code or state\", status_code=400)\n\n user: KhojUser = await aget_user_by_uuid(state) # \u003c-- No verification!\n\n await NotionConfig.objects.filter(user=user).adelete() # \u003c-- Deletes victim\u0027s config\n \n # ... OAuth token exchange ...\n \n access_token = final_response.get(\"access_token\")\n await NotionConfig.objects.acreate(token=access_token, user=user) # \u003c-- Stores attacker\u0027s token\n```\n\nTo exploit is relatively easy. Once we know the victim\u0027s UUID, we simply initiate the Notion sync process on our own account and intercept the callback, replacing the `state` parameter with the victim\u0027s UUID.\n\n### Impact\nDeletes user\u0027s existing Notion sync and replaces it with attacker-controlled Notion. Could allow for index poisoning. I\u0027m not entirely sure what Khoj does with synced files but if it\u0027s being passed as context to an LLM then I can imagine there\u0027s potential here.",
"id": "GHSA-6whj-7qmg-86qj",
"modified": "2026-02-03T16:09:54Z",
"published": "2026-02-02T17:31:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69207"
},
{
"type": "WEB",
"url": "https://github.com/khoj-ai/khoj/commit/1b7ccd141d47f365edeccc57d7316cb0913d748b"
},
{
"type": "PACKAGE",
"url": "https://github.com/khoj-ai/khoj"
},
{
"type": "WEB",
"url": "https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.23"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning"
}
GHSA-6WVP-RH8P-4Q7Q
Vulnerability from github – Published: 2024-09-25 09:30 – Updated: 2024-09-25 09:30The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFM_Customers_Manage_Controller::processing function due to missing validation on the ID user controlled key. This makes it possible for authenticated attackers, with subscriber/customer-level access and above, to change the email address of administrator user accounts which allows them to reset the password and access the administrator account.
{
"affected": [],
"aliases": [
"CVE-2024-8290"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-25T07:15:03Z",
"severity": "HIGH"
},
"details": "The WCFM \u2013 Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFM_Customers_Manage_Controller::processing function due to missing validation on the ID user controlled key. This makes it possible for authenticated attackers, with subscriber/customer-level access and above, to change the email address of administrator user accounts which allows them to reset the password and access the administrator account.",
"id": "GHSA-6wvp-rh8p-4q7q",
"modified": "2024-09-25T09:30:46Z",
"published": "2024-09-25T09:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8290"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.12/controllers/customers/wcfm-controller-customers-manage.php#L97"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3156433/wc-frontend-manager/trunk/controllers/customers/wcfm-controller-customers-manage.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/79172fe3-c0cf-48c4-8bc5-862c628c1a09?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6WWJ-XHH6-QCG8
Vulnerability from github – Published: 2026-10-20 12:31 – Updated: 2026-10-20 12:31LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
{
"affected": [],
"aliases": [
"CVE-2026-113353"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-20T11:17:19Z",
"severity": "MODERATE"
},
"details": "LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors\u0027 content. Authenticated instructors can reuse their own generic editor nonce with another object\u0027s id parameter to alter courses, change quiz answers, and trash questions.",
"id": "GHSA-6wwj-xhh6-qcg8",
"modified": "2026-10-20T12:31:35Z",
"published": "2026-10-20T12:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113353"
},
{
"type": "WEB",
"url": "https://github.com/LearnPress/learnpress/commit/77087dcdc0e974e8d0844453b4071189fc2c70d2"
},
{
"type": "WEB",
"url": "https://learnpresslms.com/changelog"
},
{
"type": "WEB",
"url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php"
},
{
"type": "WEB",
"url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/editor/class-lp-admin-editor-course.php"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/learnpress"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/learnpress-before-4.4.10-missing-authorization-via-legacy-editor-ajax-handlers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.