Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3818 vulnerabilities reference this CWE, most recent first.
GHSA-R48Q-9G5R-8Q2H
Vulnerability from github – Published: 2022-06-09 00:00 – Updated: 2022-06-17 18:18
VLAI
Summary
Authorization Bypass Through User-Controlled Key in go-restful
Details
Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.
Severity
9.1 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/emicklei/go-restful/v3"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.8.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/emicklei/go-restful"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/emicklei/go-restful/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.7.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-1996"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-09T23:50:21Z",
"nvd_published_at": "2022-06-08T13:15:00Z",
"severity": "CRITICAL"
},
"details": "Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.",
"id": "GHSA-r48q-9g5r-8q2h",
"modified": "2022-06-17T18:18:04Z",
"published": "2022-06-09T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1996"
},
{
"type": "WEB",
"url": "https://github.com/emicklei/go-restful/issues/489"
},
{
"type": "WEB",
"url": "https://github.com/emicklei/go-restful/commit/926662532deb450272956c7bc573978464aae74e"
},
{
"type": "WEB",
"url": "https://github.com/emicklei/go-restful/commit/f292efff46ae17e9d104f865a60a39a2ae9402f1"
},
{
"type": "WEB",
"url": "https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220923-0005"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0619"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1"
},
{
"type": "PACKAGE",
"url": "https://github.com/emicklei/go-restful"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Authorization Bypass Through User-Controlled Key in go-restful"
}
GHSA-R4G7-M54C-6F4W
Vulnerability from github – Published: 2025-09-22 21:30 – Updated: 2026-06-06 09:31
VLAI
Details
Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System) allows Parameter Injection.This issue affects OBS (Student Affairs Information System): before v26.0328.
Severity
4.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-0875"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-22T08:15:33Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System) allows Parameter Injection.This issue affects OBS (Student Affairs Information System): before v26.0328.",
"id": "GHSA-r4g7-m54c-6f4w",
"modified": "2026-06-06T09:31:14Z",
"published": "2025-09-22T21:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0875"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0282"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0282"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R4JV-P8QQ-69JQ
Vulnerability from github – Published: 2025-05-31 12:30 – Updated: 2025-05-31 12:30
VLAI
Details
The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-4691"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-31T12:15:20Z",
"severity": "MODERATE"
},
"details": "The Free Booking Plugin for Hotels, Restaurants and Car Rentals \u2013 eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the \u0027view_request_details\u0027 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21.",
"id": "GHSA-r4jv-p8qq-69jq",
"modified": "2025-05-31T12:30:29Z",
"published": "2025-05-31T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/easync-booking/tags/1.3.17/easync.php#L4859"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3243634"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3293607"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3300408"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9953b3-dd09-4c80-be11-4daf3bbac720?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R4XH-HP7Q-826Q
Vulnerability from github – Published: 2023-10-31 00:31 – Updated: 2023-11-06 21:31
VLAI
Details
An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data parameter.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-46478"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-30T23:15:08Z",
"severity": "HIGH"
},
"details": "An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data parameter.",
"id": "GHSA-r4xh-hp7q-826q",
"modified": "2023-11-06T21:31:06Z",
"published": "2023-10-31T00:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46478"
},
{
"type": "WEB",
"url": "https://github.com/mr-xmen786/CVE-2023-46478/tree/main"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R4XP-GCM2-3943
Vulnerability from github – Published: 2024-12-25 09:30 – Updated: 2024-12-25 09:30
VLAI
Details
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the handle_clone_post() function and the 'fusion_blog' shortcode and due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-12335"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-25T07:15:11Z",
"severity": "MODERATE"
},
"details": "The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the handle_clone_post() function and the \u0027fusion_blog\u0027 shortcode and due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.",
"id": "GHSA-r4xp-gcm2-3943",
"modified": "2024-12-25T09:30:47Z",
"published": "2024-12-25T09:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12335"
},
{
"type": "WEB",
"url": "https://avada.com"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4181dcad-b5bd-46db-b47c-3cdee427123c?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R4XR-M393-778M
Vulnerability from github – Published: 2024-11-20 12:30 – Updated: 2024-11-20 21:45
VLAI
Summary
Moodle IDOR when accessing list of course badges
Details
A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0-beta"
},
{
"fixed": "4.4.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-48899"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-20T18:25:30Z",
"nvd_published_at": "2024-11-20T11:15:05Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.",
"id": "GHSA-r4xr-m393-778m",
"modified": "2024-11-20T21:45:14Z",
"published": "2024-11-20T12:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48899"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/07ad4b8ebc715056056e01f2175820bfce6b290f"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318819"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=462878#p1858337"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Moodle IDOR when accessing list of course badges"
}
GHSA-R59X-8XCR-CC6W
Vulnerability from github – Published: 2023-11-14 06:30 – Updated: 2023-11-17 21:30
VLAI
Details
Insecure Direct Object References (IDOR) in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-43900"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-14T05:15:08Z",
"severity": "MODERATE"
},
"details": "Insecure Direct Object References (IDOR) in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters.",
"id": "GHSA-r59x-8xcr-cc6w",
"modified": "2023-11-17T21:30:26Z",
"published": "2023-11-14T06:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43900"
},
{
"type": "WEB",
"url": "https://secpro.llc/emsigner-cve-3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R5C3-XJH9-7VCW
Vulnerability from github – Published: 2025-12-23 21:30 – Updated: 2025-12-23 21:30
VLAI
Details
Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized access to another user's account.
Severity
{
"affected": [],
"aliases": [
"CVE-2021-47721"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-23T20:15:44Z",
"severity": "HIGH"
},
"details": "Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim\u0027s unique ID from the page source and replace their own session cookie to gain unauthorized access to another user\u0027s account.",
"id": "GHSA-r5c3-xjh9-7vcw",
"modified": "2025-12-23T21:30:28Z",
"published": "2025-12-23T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47721"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/50551"
},
{
"type": "WEB",
"url": "https://www.orangescrum.org"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/orangescrum-authenticated-privilege-escalation-via-user-session-manipulation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-R5JF-6F2J-GQC9
Vulnerability from github – Published: 2025-07-21 15:30 – Updated: 2026-06-05 18:31
VLAI
Details
Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers.This issue affects PAVO Pay: before 13.05.2025.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-4129"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-21T14:15:29Z",
"severity": "HIGH"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers.This issue affects PAVO Pay: before 13.05.2025.",
"id": "GHSA-r5jf-6f2j-gqc9",
"modified": "2026-06-05T18:31:30Z",
"published": "2025-07-21T15:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4129"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0166"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0166"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R5PQ-3CXR-5RMC
Vulnerability from github – Published: 2022-05-17 00:01 – Updated: 2022-05-25 00:00
VLAI
Details
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-1425"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-16T15:15:00Z",
"severity": "MODERATE"
},
"details": "The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.",
"id": "GHSA-r5pq-3cxr-5rmc",
"modified": "2022-05-25T00:00:36Z",
"published": "2022-05-17T00:01:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1425"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/b110e2f7-4aa3-47b5-a8f2-0a7fe53cc467"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.