CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3822 vulnerabilities reference this CWE, most recent first.
GHSA-W365-QPC6-8W95
Vulnerability from github – Published: 2023-07-11 00:33 – Updated: 2024-04-04 05:54A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further intervention is required.
{
"affected": [],
"aliases": [
"CVE-2023-30960"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-10T22:15:09Z",
"severity": "MODERATE"
},
"details": "A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further intervention is required.\n\n\n\n",
"id": "GHSA-w365-qpc6-8w95",
"modified": "2024-04-04T05:54:17Z",
"published": "2023-07-11T00:33:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30960"
},
{
"type": "WEB",
"url": "https://palantir.safebase.us/?tcuUid=115d9bf4-201f-4cfe-b2fc-219e3a2d945b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W3J8-9P3J-3WJX
Vulnerability from github – Published: 2025-12-17 18:31 – Updated: 2025-12-18 15:39An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
The project was archived as of December 1, 2023.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pagekit/pagekit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-67165"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-18T15:39:04Z",
"nvd_published_at": "2025-12-17T17:15:51Z",
"severity": "CRITICAL"
},
"details": "An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.\n\nThe project was archived as of December 1, 2023.",
"id": "GHSA-w3j8-9p3j-3wjx",
"modified": "2025-12-18T15:39:04Z",
"published": "2025-12-17T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67165"
},
{
"type": "WEB",
"url": "https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67165"
},
{
"type": "WEB",
"url": "https://github.com/pagekit/docs/blob/develop/user-interface/users.md#permissions"
},
{
"type": "WEB",
"url": "https://github.com/pagekit/docs/blob/develop/user-interface/users.md#roles"
},
{
"type": "PACKAGE",
"url": "https://github.com/pagekit/pagekit"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component"
}
GHSA-W3XR-4XQ6-F7JX
Vulnerability from github – Published: 2026-08-04 09:31 – Updated: 2026-08-04 15:32The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.
{
"affected": [],
"aliases": [
"CVE-2026-16070"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-04T07:16:29Z",
"severity": "LOW"
},
"details": "The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template\u0027s type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.",
"id": "GHSA-w3xr-4xq6-f7jx",
"modified": "2026-08-04T15:32:22Z",
"published": "2026-08-04T09:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16070"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/aa57d5b9-ba51-476c-9e64-fd431b89fa8a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W494-P3QW-3WW3
Vulnerability from github – Published: 2025-02-14 09:31 – Updated: 2025-02-15 18:30StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.
{
"affected": [],
"aliases": [
"CVE-2025-26788"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-14T08:15:31Z",
"severity": "HIGH"
},
"details": "StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.",
"id": "GHSA-w494-p3qw-3ww3",
"modified": "2025-02-15T18:30:25Z",
"published": "2025-02-14T09:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26788"
},
{
"type": "WEB",
"url": "https://docs.strongkey.com/index.php/skfs-v3/skfs-release-notes"
},
{
"type": "WEB",
"url": "https://www.securing.pl/en/cve-2025-26788-passkey-authentication-bypass-in-strongkey-fido-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-W4C2-J77V-WMG3
Vulnerability from github – Published: 2024-11-13 00:30 – Updated: 2024-11-18 21:30SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dashboard and perform actions like modify user, delete user, etc.
{
"affected": [],
"aliases": [
"CVE-2021-27700"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T23:15:03Z",
"severity": "HIGH"
},
"details": "SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dashboard and perform actions like modify user, delete user, etc.",
"id": "GHSA-w4c2-j77v-wmg3",
"modified": "2024-11-18T21:30:44Z",
"published": "2024-11-13T00:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27700"
},
{
"type": "WEB",
"url": "https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2021-27700"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-W4FH-P39J-749C
Vulnerability from github – Published: 2022-08-29 20:06 – Updated: 2022-09-02 00:01The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
{
"affected": [],
"aliases": [
"CVE-2022-3019"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-29T06:15:00Z",
"severity": "HIGH"
},
"details": "The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id\u0027s might also be an option but I wouldn\u0027t count on it, since it would take a long time to find a valid one).",
"id": "GHSA-w4fh-p39j-749c",
"modified": "2022-09-02T00:01:03Z",
"published": "2022-08-29T20:06:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3019"
},
{
"type": "WEB",
"url": "https://github.com/tooljet/tooljet/commit/45e0d3302d92df7d7f2d609c31cea71165600b79"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a610300b-ce3c-4995-8337-11942b3621bf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W4XP-6Q8W-6C3G
Vulnerability from github – Published: 2025-02-03 15:32 – Updated: 2026-04-01 18:33Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support. This issue affects Nirweb support: from n/a through 3.0.3.
{
"affected": [],
"aliases": [
"CVE-2025-22695"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-03T15:15:19Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support. This issue affects Nirweb support: from n/a through 3.0.3.",
"id": "GHSA-w4xp-6q8w-6c3g",
"modified": "2026-04-01T18:33:31Z",
"published": "2025-02-03T15:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22695"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/nirweb-support/vulnerability/wordpress-nirweb-support-plugin-3-0-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W5F6-5HGR-5MP9
Vulnerability from github – Published: 2026-05-02 15:30 – Updated: 2026-05-02 15:30The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators.
{
"affected": [],
"aliases": [
"CVE-2026-2554"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-02T14:16:17Z",
"severity": "HIGH"
},
"details": "The WCFM \u2013 Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the \u0027wcfm_delete_wcfm_customer\u0027 due to missing validation on the \u0027customerid\u0027 user controlled key. This makes it possible for authenticated attackers, with Vendor-level access and above, to delete arbitrary users, including Administrators.",
"id": "GHSA-w5f6-5hgr-5mp9",
"modified": "2026-05-02T15:30:25Z",
"published": "2026-05-02T15:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2554"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.24/core/class-wcfm-customer.php#L386"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3483695"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/21e397a4-0b32-4b13-a46b-c465acea0796?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W5VW-X33C-R8G6
Vulnerability from github – Published: 2023-03-13 18:30 – Updated: 2023-03-16 18:30The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
{
"affected": [],
"aliases": [
"CVE-2023-0772"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-13T17:15:00Z",
"severity": "MODERATE"
},
"details": "The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.",
"id": "GHSA-w5vw-x33c-r8g6",
"modified": "2023-03-16T18:30:32Z",
"published": "2023-03-13T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0772"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/28754886-b7b4-44f7-9042-b81c542d3c9c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W66M-FF3X-XXXR
Vulnerability from github – Published: 2025-04-16 00:31 – Updated: 2025-04-16 00:31Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
{
"affected": [],
"aliases": [
"CVE-2025-24315"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-15T22:15:16Z",
"severity": "MODERATE"
},
"details": "Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).",
"id": "GHSA-w66m-ff3x-xxxr",
"modified": "2025-04-16T00:31:35Z",
"published": "2025-04-16T00:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24315"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.