Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

5432 vulnerabilities reference this CWE, most recent first.

GHSA-926C-Q529-62WH

Vulnerability from github – Published: 2026-10-12 15:32 – Updated: 2026-10-12 15:32
VLAI
Details

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-109176"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-12T13:17:30Z",
    "severity": "MODERATE"
  },
  "details": "MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators\u0027 files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator\u0027s file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.",
  "id": "GHSA-926c-q529-62wh",
  "modified": "2026-10-12T15:32:14Z",
  "published": "2026-10-12T15:32:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109176"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mogu_blog_v2/poc_networkDisk_ownership.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_picture/src/main/java/com/moxi/mogublog/picture/restapi/NetworkDiskRestApi.java#L97-L120"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/NetworkDiskServiceImpl.java#L134-L231"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/mogublog-through-6.2-idor-allows-deleting-other-administrators-network-disk-files"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-9284-FJC3-FMMJ

Vulnerability from github – Published: 2026-08-24 19:40 – Updated: 2026-08-24 19:40
VLAI
Summary
Sakai Profile Image Deletion has an IDOR
Details

Summary

The Sakai REST API endpoint DELETE /api/users/{userId}/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId in the path. The service layer has no authorization check, and the delete cascades through Content Hosting Service (CHS) with a security advisor that bypasses all CHS permission checks.

Details

ProfileController.removeProfileImage() in the webapi module retrieves the current user's session but performs no comparison between the authenticated user and the target userId path parameter:

@DeleteMapping(value = "/users/{userId}/profile/image")
public ResponseEntity<String> removeProfileImage(@PathVariable String userId) {
    String currentUserId = checkSakaiSession().getUserId();
    if (currentUserId == null) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
    }
    profileService.removeProfileImage(userId);  // userId is attacker-controlled
    return ResponseEntity.ok().build();
}

ProfileServiceImpl.removeProfileImage() delegates directly to dao.removeProfileImage(userUuid) with no authorization check. The DAO calls profileImageUploadedRepository.deleteById(userId), removing the profile_images_t row unconditionally.

For contrast, the upload endpoint setProfileImage() correctly verifies ownership:

if (!sakaiProxy.isSuperUser() && !StringUtils.equals(currentUserUuid, userUuid)) {
    throw new SecurityException("Not allowed to save.");
}

This asymmetry means any authenticated user can delete but not upload over another user's profile image.

Additionally, the pronunciation recording delete endpoint (DELETE /api/users/{userId}/profile/pronunciation) has no checkSakaiSession() call at all, making it accessible without any authentication.

Setup: - Admin user: admin, with a custom profile image uploaded - Attacker: student2 (unprivileged user, SAKAIID cookie from authenticated session)

Step 1 - Admin uploads profile image (confirm non-default state):

POST /api/users/admin/profile/image HTTP/1.1
Cookie: SAKAIID=<admin-session>
Content-Type: application/x-www-form-urlencoded

base64=<base64-encoded-png>

Response: {"status":"SUCCESS"}

Step 2 - Verify image exists in database:

SELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t WHERE USER_UUID='admin';
-- Result: admin | /private/profileImages/admin/1/eb92b129-9b00-4978-aec3-be840455d8e9

Step 3 - Attacker (student2) deletes admin's profile image:

DELETE /api/users/admin/profile/image HTTP/1.1
Host: localhost:9107
Cookie: SAKAIID=974996f4-e9c1-441c-9ab9-d3646aa5c754.9799861f31fb

Response: HTTP/1.1 200

Step 4 - Verify image is gone from database:

SELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t WHERE USER_UUID='admin';
-- Result: (empty - row deleted)

The attack succeeds. Student2's session is accepted by checkSakaiSession() (non-blank userId), and the target userId (admin) is passed directly to the service without any ownership check.

Impact

Any authenticated user (student, guest) can: - Permanently delete the profile image of any other user, including administrators and instructors - Repeatedly trigger deletion to prevent a target user from maintaining a profile picture - In a university context where profile photos are used for identity verification in proctored exams or student directories, this could disrupt identity management workflows

The attack is trivially scriptable and can target all users on the platform in bulk.

Suggested Remediation

In ProfileController.removeProfileImage(), add an ownership check before calling the service:

@DeleteMapping(value = "/users/{userId}/profile/image")
public ResponseEntity<String> removeProfileImage(@PathVariable String userId) {
    Session session = checkSakaiSession();
    String currentUserId = session.getUserId();
    if (currentUserId == null) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
    }
    // Add this check:
    if (!sakaiProxy.isSuperUser() && !currentUserId.equals(userId)) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
    }
    profileService.removeProfileImage(userId);
    return ResponseEntity.ok().build();
}

Apply the same ownership check in ProfileServiceImpl.removeProfileImage() for defense-in-depth, mirroring the pattern in setProfileImage().

For the pronunciation endpoint, add checkSakaiSession() and the same ownership check.

Status / timeline:

  • 2026-06-02: Fix committed to master (a092dbf3dc6bf343131f50007c207a9abd95e852)
  • Release pending.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.sakaiproject.profile2:profile2-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "23.0"
            },
            {
              "fixed": "23.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.sakaiproject.profile2:profile2-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "25.0"
            },
            {
              "last_affected": "25.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.sakaiproject.profile2:profile2-impl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "23.0"
            },
            {
              "fixed": "23.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.sakaiproject.profile2:profile2-impl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "25.0"
            },
            {
              "last_affected": "25.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54050"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-24T19:40:37Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe Sakai REST API endpoint `DELETE /api/users/{userId}/profile/image` does not verify that the requesting user is authorized to modify the target user\u0027s profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different `userId` in the path. The service layer has no authorization check, and the delete cascades through Content Hosting Service (CHS) with a security advisor that bypasses all CHS permission checks.\n\n### Details\n`ProfileController.removeProfileImage()` in the webapi module retrieves the current user\u0027s session but performs no comparison between the authenticated user and the target `userId` path parameter:\n\n```java\n@DeleteMapping(value = \"/users/{userId}/profile/image\")\npublic ResponseEntity\u003cString\u003e removeProfileImage(@PathVariable String userId) {\n    String currentUserId = checkSakaiSession().getUserId();\n    if (currentUserId == null) {\n        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();\n    }\n    profileService.removeProfileImage(userId);  // userId is attacker-controlled\n    return ResponseEntity.ok().build();\n}\n```\n\n`ProfileServiceImpl.removeProfileImage()` delegates directly to `dao.removeProfileImage(userUuid)` with no authorization check. The DAO calls `profileImageUploadedRepository.deleteById(userId)`, removing the `profile_images_t` row unconditionally.\n\nFor contrast, the upload endpoint `setProfileImage()` correctly verifies ownership:\n\n```java\nif (!sakaiProxy.isSuperUser() \u0026\u0026 !StringUtils.equals(currentUserUuid, userUuid)) {\n    throw new SecurityException(\"Not allowed to save.\");\n}\n```\n\nThis asymmetry means any authenticated user can delete but not upload over another user\u0027s profile image.\n\nAdditionally, the pronunciation recording delete endpoint (`DELETE /api/users/{userId}/profile/pronunciation`) has no `checkSakaiSession()` call at all, making it accessible without any authentication.\n\n\n**Setup:**\n- Admin user: `admin`, with a custom profile image uploaded\n- Attacker: `student2` (unprivileged user, SAKAIID cookie from authenticated session)\n\n**Step 1 - Admin uploads profile image (confirm non-default state):**\n\n```\nPOST /api/users/admin/profile/image HTTP/1.1\nCookie: SAKAIID=\u003cadmin-session\u003e\nContent-Type: application/x-www-form-urlencoded\n\nbase64=\u003cbase64-encoded-png\u003e\n```\n\nResponse: `{\"status\":\"SUCCESS\"}`\n\n**Step 2 - Verify image exists in database:**\n\n```sql\nSELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t WHERE USER_UUID=\u0027admin\u0027;\n-- Result: admin | /private/profileImages/admin/1/eb92b129-9b00-4978-aec3-be840455d8e9\n```\n\n**Step 3 - Attacker (student2) deletes admin\u0027s profile image:**\n\n```\nDELETE /api/users/admin/profile/image HTTP/1.1\nHost: localhost:9107\nCookie: SAKAIID=974996f4-e9c1-441c-9ab9-d3646aa5c754.9799861f31fb\n```\n\nResponse: `HTTP/1.1 200`\n\n**Step 4 - Verify image is gone from database:**\n\n```sql\nSELECT USER_UUID, RESOURCE_MAIN FROM profile_images_t WHERE USER_UUID=\u0027admin\u0027;\n-- Result: (empty - row deleted)\n```\n\nThe attack succeeds. Student2\u0027s session is accepted by `checkSakaiSession()` (non-blank userId), and the target userId (`admin`) is passed directly to the service without any ownership check.\n\n### Impact\n\nAny authenticated user (student, guest) can:\n- Permanently delete the profile image of any other user, including administrators and instructors\n- Repeatedly trigger deletion to prevent a target user from maintaining a profile picture\n- In a university context where profile photos are used for identity verification in proctored exams or student directories, this could disrupt identity management workflows\n\nThe attack is trivially scriptable and can target all users on the platform in bulk.\n\n### Suggested Remediation\n\nIn `ProfileController.removeProfileImage()`, add an ownership check before calling the service:\n\n```java\n@DeleteMapping(value = \"/users/{userId}/profile/image\")\npublic ResponseEntity\u003cString\u003e removeProfileImage(@PathVariable String userId) {\n    Session session = checkSakaiSession();\n    String currentUserId = session.getUserId();\n    if (currentUserId == null) {\n        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();\n    }\n    // Add this check:\n    if (!sakaiProxy.isSuperUser() \u0026\u0026 !currentUserId.equals(userId)) {\n        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();\n    }\n    profileService.removeProfileImage(userId);\n    return ResponseEntity.ok().build();\n}\n```\n\nApply the same ownership check in `ProfileServiceImpl.removeProfileImage()` for defense-in-depth, mirroring the pattern in `setProfileImage()`.\n\nFor the pronunciation endpoint, add `checkSakaiSession()` and the same ownership check.\n\n### Status / timeline:\n- 2026-06-02: Fix committed to master (`a092dbf3dc6bf343131f50007c207a9abd95e852`)\n- Release pending.",
  "id": "GHSA-9284-fjc3-fmmj",
  "modified": "2026-08-24T19:40:37Z",
  "published": "2026-08-24T19:40:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-9284-fjc3-fmmj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sakaiproject/sakai/commit/a092dbf3dc6bf343131f50007c207a9abd95e852"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sakaiproject/sakai"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sakaiproject/sakai/releases/tag/23.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sakai Profile Image Deletion has an IDOR"
}

GHSA-9285-889V-MP3C

Vulnerability from github – Published: 2026-08-11 15:32 – Updated: 2026-09-01 21:31
VLAI
Details

n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow (when workflow sharing is enabled) who knows a target credential's ID can reference that credential in the inline JSON; it passes save-time and runtime validation and resolves in the parent workflow's project context, allowing the attacker to use or exfiltrate credentials they are not permitted to access.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
7.2 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-72763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T13:19:06Z",
    "severity": "HIGH"
  },
  "details": "n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node\u0027s top-level credentials and not for credentials referenced inside an Execute Sub-workflow node\u0027s inline workflow JSON. A member with Editor access to a shared workflow (when workflow sharing is enabled) who knows a target credential\u0027s ID can reference that credential in the inline JSON; it passes save-time and runtime validation and resolves in the parent workflow\u0027s project context, allowing the attacker to use or exfiltrate credentials they are not permitted to access.",
  "id": "GHSA-9285-889v-mp3c",
  "modified": "2026-09-01T21:31:16Z",
  "published": "2026-08-11T15:32:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-cj9h-qx8g-pq2g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72763"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/n8n-before-credential-exfiltration-via-sub-workflow"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-92CG-GHQ6-9587

Vulnerability from github – Published: 2023-12-12 03:31 – Updated: 2024-09-30 18:52
Withdrawn 2024-09-30 VLAI
Summary
Duplicate Advisory: Privilege escalation in sap/cloud-security-client-go
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-m8rw-rcpq-2vp2. This link is maintained to preserve external references.

Original Description

SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/sap/cloud-security-client-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-639",
      "CWE-749"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-15T03:39:45Z",
    "nvd_published_at": "2023-12-12T03:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-m8rw-rcpq-2vp2. This link is maintained to preserve external references.\n\n## Original Description\nSAP\u00a0BTP\u00a0Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions \u003c 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.\n\n",
  "id": "GHSA-92cg-ghq6-9587",
  "modified": "2024-09-30T18:52:24Z",
  "published": "2023-12-12T03:31:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50424"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SAP/cloud-security-client-go/commit/2e3bd63e152e09f267316a1071034eb5d4b7f498"
    },
    {
      "type": "WEB",
      "url": "https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SAP/cloud-security-client-go"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3411067"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/github.com/sap/cloud-security-client-go@v0.17.0"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Duplicate Advisory: Privilege escalation in sap/cloud-security-client-go",
  "withdrawn": "2024-09-30T18:52:24Z"
}

GHSA-92QM-MQ2F-95W2

Vulnerability from github – Published: 2024-05-02 18:30 – Updated: 2026-04-08 18:33
VLAI
Details

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads visible.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-2346"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-02T17:15:16Z",
    "severity": "MODERATE"
  },
  "details": "The FileBird \u2013 WordPress Media Library Folders \u0026 File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads visible.",
  "id": "GHSA-92qm-mq2f-95w2",
  "modified": "2026-04-08T18:33:03Z",
  "published": "2024-05-02T18:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2346"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3060898%40filebird%2Ftrunk\u0026old=3049188%40filebird%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/82cde234-ae87-438f-911e-bdd0e3ac1132?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9324-W765-4VQ2

Vulnerability from github – Published: 2026-06-29 09:30 – Updated: 2026-06-29 09:30
VLAI
Details

Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Simple User Avatar: from n/a through 4.9.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-57676"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-29T09:16:31Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Simple User Avatar: from n/a through 4.9.",
  "id": "GHSA-9324-w765-4vq2",
  "modified": "2026-06-29T09:30:29Z",
  "published": "2026-06-29T09:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57676"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/simple-user-avatar/vulnerability/wordpress-simple-user-avatar-plugin-4-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-93M5-29FC-FVM2

Vulnerability from github – Published: 2026-10-13 12:32 – Updated: 2026-10-13 12:32
VLAI
Details

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-89202"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-13T10:17:21Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.",
  "id": "GHSA-93m5-29fc-fvm2",
  "modified": "2026-10-13T12:32:58Z",
  "published": "2026-10-13T12:32:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89202"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-508506.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-93RH-HCCW-9Q28

Vulnerability from github – Published: 2025-09-30 12:30 – Updated: 2025-10-08 21:30
VLAI
Details

Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to calendar details using unauthorised internal identifiers.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-41091"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-30T11:37:39Z",
    "severity": "HIGH"
  },
  "details": "Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to\u00a0access to calendar details using unauthorised internal identifiers.",
  "id": "GHSA-93rh-hccw-9q28",
  "modified": "2025-10-08T21:30:23Z",
  "published": "2025-09-30T12:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41091"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-93WV-GHWM-F3XH

Vulnerability from github – Published: 2026-10-30 15:34 – Updated: 2026-10-30 15:34
VLAI
Details

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-119652"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-30T15:16:48Z",
    "severity": "MODERATE"
  },
  "details": "HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users\u0027 friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim\u0027s uid, bypassing the missing administrator or owner check to read any user\u0027s contact list.",
  "id": "GHSA-93wv-ghwm-f3xh",
  "modified": "2026-10-30T15:34:38Z",
  "published": "2026-10-30T15:34:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119652"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HuLaSpark/HuLa-Server/issues/34"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HuLaSpark/HuLa-Server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-controller/src/main/java/com/luohuo/flex/im/controller/user/FriendController.java#L59-L66"
    },
    {
      "type": "WEB",
      "url": "https://hackmd.io/@hieuPenguinnn/hula-server-idor-privacy-feed-friend"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/hula-server-through-3.0.7-idor-via-user-friend-page-friend-list-disclosure"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-943C-GHG8-8G2W

Vulnerability from github – Published: 2026-02-05 12:30 – Updated: 2026-02-05 12:30
VLAI
Details

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.7.2 via the 'pm_upload_image' and 'pm_upload_cover_image' AJAX actions. This is due to the update_user_meta() function being called outside of the user authorization check in public/partials/crop.php and public/partials/coverimg_crop.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change any user's profile picture or cover image, including administrators.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-1271"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-05T10:16:03Z",
    "severity": "MODERATE"
  },
  "details": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.7.2 via the \u0027pm_upload_image\u0027 and \u0027pm_upload_cover_image\u0027 AJAX actions. This is due to the update_user_meta() function being called outside of the user authorization check in public/partials/crop.php and public/partials/coverimg_crop.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change any user\u0027s profile picture or cover image, including administrators.",
  "id": "GHSA-943c-ghg8-8g2w",
  "modified": "2026-02-05T12:30:25Z",
  "published": "2026-02-05T12:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1271"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.6.7/public/partials/coverimg_crop.php#L60"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.6.7/public/partials/crop.php#L73"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/partials/coverimg_crop.php#L60"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/partials/crop.php#L73"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3448434%40profilegrid-user-profiles-groups-and-communities\u0026new=3448434%40profilegrid-user-profiles-groups-and-communities\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/712535ce-8c38-4944-aa0a-36d9bacaeb67?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list