Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

5459 vulnerabilities reference this CWE, most recent first.

GHSA-729R-Q9XR-M8J5

Vulnerability from github – Published: 2022-04-07 00:00 – Updated: 2022-04-14 00:00
VLAI
Details

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any user can create a timesheet in another user's account.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-27108"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-06T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any user can create a timesheet in another user\u0027s account.",
  "id": "GHSA-729r-q9xr-m8j5",
  "modified": "2022-04-14T00:00:30Z",
  "published": "2022-04-07T00:00:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orangehrm/orangehrm/issues/1173"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-72F9-GHC4-FPV2

Vulnerability from github – Published: 2025-12-27 12:30 – Updated: 2025-12-27 12:30
VLAI
Details

A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the component Authentication Endpoint. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-15106"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-266",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-27T11:15:51Z",
    "severity": "MODERATE"
  },
  "details": "A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the component Authentication Endpoint. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-72f9-ghc4-fpv2",
  "modified": "2025-12-27T12:30:12Z",
  "published": "2025-12-27T12:30:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15106"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/H2u8s/1a0bdb19d5c8c8f4dc72cb49ffe9a22b"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.338477"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.338477"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.710268"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-72H8-WP98-7HCH

Vulnerability from github – Published: 2026-09-22 20:36 – Updated: 2026-09-22 20:36
VLAI
Summary
Unleash: Missing await on permission check + cross-project IDOR in admin API
Details

Summary

Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check.

Vulnerability 1: Missing await on Permission Check (HIGH)

File: src/lib/features/segment/segment-controller.ts (line 345)

POST /api/admin/segments/strategies has permission: NONE at the route level. The handler performs its own check via this.accessService.hasPermission(), but omits the await keyword. Since hasPermission() is async (returns Promise<boolean>), the variable always receives a truthy Promise object. The if (!hasFeatureStrategyPermission) check never triggers.

// BUG: missing await - hasPermission() returns Promise<boolean>
const hasFeatureStrategyPermission = this.accessService.hasPermission(
    req.user, UPDATE_FEATURE_STRATEGY, projectId, environmentId,
);
if (!hasFeatureStrategyPermission) { // Always false - Promise is truthy!
    res.status(403).send();
    return;
}

Impact: Any authenticated user can modify segment assignments on ANY strategy across ALL projects.

Fix: Add await: const hasFeatureStrategyPermission = await this.accessService.hasPermission(...)

Vulnerability 2: Cross-Project Variant Read (MEDIUM)

File: src/lib/routes/admin-api/project/variants.ts (line 213-223)

GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants completely ignores projectId. getVariantsOnEnv() only uses featureName and environment.

Impact: Any authenticated user can read variant configs (names, weights, payloads) from any project.

Vulnerability 3: Cross-Project Strategy Read (MEDIUM)

File: src/lib/features/feature-toggle/feature-toggle-controller.ts (line 1107-1116)

GET .../strategies/:strategyId ignores all params except strategyId. Any authenticated user can read any strategy's full configuration.

Vulnerability 4: Cross-Project Environment Info Leak (MEDIUM)

File: src/lib/features/feature-toggle/feature-toggle-service.ts (line 1611)

getEnvironmentInfo() doesn't validate feature belongs to project. Compare with getFeature() which calls validateFeatureBelongsToProject().

Vulnerability 5: Cross-Project Tag Modification (LOW)

File: src/lib/features/feature-toggle/feature-toggle-controller.ts (line 576-596)

PUT /:projectId/tags accepts features array in body without validating they belong to projectId.

Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "unleash-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77426"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:36:42Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nMultiple authorization vulnerabilities in Unleash admin API, including a critical missing `await` that completely bypasses a permission check.\n\n## Vulnerability 1: Missing `await` on Permission Check (HIGH)\n\n**File:** `src/lib/features/segment/segment-controller.ts` (line 345)\n\n`POST /api/admin/segments/strategies` has `permission: NONE` at the route level. The handler performs its own check via `this.accessService.hasPermission()`, but **omits the `await` keyword**. Since `hasPermission()` is async (returns `Promise\u003cboolean\u003e`), the variable always receives a truthy Promise object. The `if (!hasFeatureStrategyPermission)` check never triggers.\n\n```typescript\n// BUG: missing await - hasPermission() returns Promise\u003cboolean\u003e\nconst hasFeatureStrategyPermission = this.accessService.hasPermission(\n    req.user, UPDATE_FEATURE_STRATEGY, projectId, environmentId,\n);\nif (!hasFeatureStrategyPermission) { // Always false - Promise is truthy!\n    res.status(403).send();\n    return;\n}\n```\n\n**Impact:** Any authenticated user can modify segment assignments on ANY strategy across ALL projects.\n\n**Fix:** Add `await`: `const hasFeatureStrategyPermission = await this.accessService.hasPermission(...)`\n\n## Vulnerability 2: Cross-Project Variant Read (MEDIUM)\n\n**File:** `src/lib/routes/admin-api/project/variants.ts` (line 213-223)\n\n`GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants` completely ignores `projectId`. `getVariantsOnEnv()` only uses `featureName` and `environment`.\n\n**Impact:** Any authenticated user can read variant configs (names, weights, payloads) from any project.\n\n## Vulnerability 3: Cross-Project Strategy Read (MEDIUM)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-controller.ts` (line 1107-1116)\n\n`GET .../strategies/:strategyId` ignores all params except `strategyId`. Any authenticated user can read any strategy\u0027s full configuration.\n\n## Vulnerability 4: Cross-Project Environment Info Leak (MEDIUM)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-service.ts` (line 1611)\n\n`getEnvironmentInfo()` doesn\u0027t validate feature belongs to project. Compare with `getFeature()` which calls `validateFeatureBelongsToProject()`.\n\n## Vulnerability 5: Cross-Project Tag Modification (LOW)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-controller.ts` (line 576-596)\n\n`PUT /:projectId/tags` accepts features array in body without validating they belong to projectId.",
  "id": "GHSA-72h8-wp98-7hch",
  "modified": "2026-09-22T20:36:42Z",
  "published": "2026-09-22T20:36:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-72h8-wp98-7hch"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Unleash/unleash/commit/7bb2829fc40791aa478e8ffca149c11b0f9cb05a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Unleash/unleash/commit/ace121c922d2e3eb6f68d95b0b6ab2fc8d824ea1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Unleash/unleash/commit/bea7effd3687425630423f662136d548e100154d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Unleash/unleash/commit/c93a963e95e1b7bf1bca2a7729282a48d0eb2f6a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Unleash/unleash/commit/dd61d0e10f5977a2e5de78df467c3a17c09fbcef"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Unleash/unleash"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Unleash/unleash/releases/tag/v8.0.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Unleash: Missing await on permission check + cross-project IDOR in admin API"
}

GHSA-72P9-6VV6-GVQH

Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-07-01 19:47
VLAI
Summary
pretix vulnerable to Authorization Bypass Through User-Controlled Key
Details

When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places in pretix when temporary files are generated for internal use or download.

One remaining API endpoint, however, wrongfully did not verify if the UUID used for download actually belongs to a file that is supposed to be downloadable and belongs to the correct user. In reality, this is hard to exploit because an attacker would need to have access to a valid UUID for the file they desire which is unlikely to happen without a separate security problem giving them access to logs etc.

Severity
3.8 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pretix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-9712"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T19:47:20Z",
    "nvd_published_at": "2026-05-27T15:16:36Z",
    "severity": "LOW"
  },
  "details": "When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places in pretix when temporary files are generated for internal use or download.\n\nOne remaining API endpoint, however, wrongfully did not verify if the UUID used for download actually belongs to a file that is supposed to be downloadable and belongs to the correct user. In reality, this is hard to exploit because an attacker would need to have access to a valid UUID for the file they desire which is unlikely to happen without a separate security problem giving them access to logs etc.",
  "id": "GHSA-72p9-6vv6-gvqh",
  "modified": "2026-07-01T19:47:20Z",
  "published": "2026-05-27T15:33:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9712"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pretix/pretix"
    },
    {
      "type": "WEB",
      "url": "https://pretix.eu/about/en/blog/20260527-release-2026-4-2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pretix vulnerable to Authorization Bypass Through User-Controlled Key"
}

GHSA-72PH-PRPQ-5J96

Vulnerability from github – Published: 2025-12-11 15:30 – Updated: 2026-06-04 09:30
VLAI
Details

Authorization Bypass Through User-Controlled Key vulnerability in Netiket Information Technologies Ltd. Co. ApplyLogic allows Exploitation of Trusted Identifiers.This issue affects ApplyLogic: through 01.12.2025.

Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-13124"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-11T15:15:46Z",
    "severity": "HIGH"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Netiket Information Technologies Ltd. Co. ApplyLogic allows Exploitation of Trusted Identifiers.This issue affects ApplyLogic: through 01.12.2025.",
  "id": "GHSA-72ph-prpq-5j96",
  "modified": "2026-06-04T09:30:33Z",
  "published": "2025-12-11T15:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13124"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0447"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-25-0447"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-72QW-2QPQ-FG7J

Vulnerability from github – Published: 2026-07-22 21:32 – Updated: 2026-07-27 18:31
VLAI
Details

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.

Severity
9.6 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-16624"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-22T19:16:58Z",
    "severity": "CRITICAL"
  },
  "details": "Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.",
  "id": "GHSA-72qw-2qpq-fg7j",
  "modified": "2026-07-27T18:31:41Z",
  "published": "2026-07-22T21:32:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-4fwh-xxpv-xfm6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16624"
    },
    {
      "type": "WEB",
      "url": "https://vokecyber.com/research/calcom-cross-tenant-webhook-plant"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-72XP-24P9-7VPF

Vulnerability from github – Published: 2026-08-12 21:31 – Updated: 2026-09-03 23:00
Withdrawn 2026-09-03 VLAI
Summary
Duplicate Advisory: Absolute filesystem path and OS username disclosure via resolveAssetPath
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-jv8v-xq2h-657v. This link is maintained to preserve external references.

Original Description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to obtain the server's absolute workspace path, disclosing the operating-system username and installation layout.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T23:00:03Z",
    "nvd_published_at": "2026-08-12T20:17:52Z",
    "severity": "MODERATE"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-jv8v-xq2h-657v. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to obtain the server\u0027s absolute workspace path, disclosing the operating-system username and installation layout.",
  "id": "GHSA-72xp-24p9-7vpf",
  "modified": "2026-09-03T23:00:03Z",
  "published": "2026-08-12T21:31:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jv8v-xq2h-657v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72802"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-resolveassetpath"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Absolute filesystem path and OS username disclosure via resolveAssetPath",
  "withdrawn": "2026-09-03T23:00:03Z"
}

GHSA-7359-RM9Q-RGHC

Vulnerability from github – Published: 2026-07-22 00:32 – Updated: 2026-07-22 00:32
VLAI
Details

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-65316"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T22:19:10Z",
    "severity": "HIGH"
  },
  "details": "XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.",
  "id": "GHSA-7359-rm9q-rghc",
  "modified": "2026-07-22T00:32:34Z",
  "published": "2026-07-22T00:32:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65316"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xuxueli/xxl-job/issues/3983"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xuxueli/xxl-job"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/xxl-job-cross-job-group-log-disclosure-via-missing-authorization-check-in-joblog-logdetailcat"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7362-RVW7-57JJ

Vulnerability from github – Published: 2025-04-15 21:31 – Updated: 2025-04-15 21:31
VLAI
Details

Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-30514"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-15T21:15:57Z",
    "severity": "MODERATE"
  },
  "details": "Unauthenticated attackers can obtain restricted information about a user\u0027s smart device collections (i.e., \"scenes\").",
  "id": "GHSA-7362-rvw7-57jj",
  "modified": "2025-04-15T21:31:45Z",
  "published": "2025-04-15T21:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30514"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-736C-QMFV-4R4H

Vulnerability from github – Published: 2023-11-08 00:30 – Updated: 2023-11-15 18:30
VLAI
Details

In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can download personal information from ps_customer/ps_address tables such as name / surname / phone number / full postal address.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-45380"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-07T23:15:07Z",
    "severity": "HIGH"
  },
  "details": "In the module \"Order Duplicator \" Clone and Delete Existing Order\" (orderduplicate) in version \u003c= 1.1.7 from Silbersaiten for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can download personal information from ps_customer/ps_address tables such as name / surname / phone number / full postal address.",
  "id": "GHSA-736c-qmfv-4r4h",
  "modified": "2023-11-15T18:30:21Z",
  "published": "2023-11-08T00:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45380"
    },
    {
      "type": "WEB",
      "url": "https://security.friendsofpresta.org/modules/2023/11/07/orderduplicate.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list