CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5432 vulnerabilities reference this CWE, most recent first.
GHSA-95F4-RR4J-J25Q
Vulnerability from github – Published: 2026-09-04 12:31 – Updated: 2026-09-04 12:31Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for acceptances belonging to other companies by exploiting a null check on the legacy users.company_id column.
{
"affected": [],
"aliases": [
"CVE-2026-85616"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T12:17:25Z",
"severity": "HIGH"
},
"details": "Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for acceptances belonging to other companies by exploiting a null check on the legacy users.company_id column.",
"id": "GHSA-95f4-rr4j-j25q",
"modified": "2026-09-04T12:31:01Z",
"published": "2026-09-04T12:31:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-jqgw-vpjc-86fc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85616"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.6.2-authorization-bypass-via-checkout-acceptance"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-95XJ-7GCG-RWQR
Vulnerability from github – Published: 2026-10-13 18:30 – Updated: 2026-10-13 18:30PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.
{
"affected": [],
"aliases": [
"CVE-2026-110121"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T17:17:36Z",
"severity": "HIGH"
},
"details": "PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store\u0027s product by supplying another store\u0027s goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.",
"id": "GHSA-95xj-7gcg-rwqr",
"modified": "2026-10-13T18:30:55Z",
"published": "2026-10-13T18:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110121"
},
{
"type": "WEB",
"url": "https://github.com/lilishop/lilishop/blob/v4.4/framework/src/main/java/cn/lili/modules/goods/serviceimpl/GoodsServiceImpl.java#L198-L222"
},
{
"type": "WEB",
"url": "https://github.com/lilishop/lilishop/blob/v4.4/seller-api/src/main/java/cn/lili/controller/goods/GoodsStoreController.java#L143-L147"
},
{
"type": "WEB",
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/lilishop-seller-goods-cross-store-authz-bypass"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/pickmall-lilishop-through-4.4-idor-via-goods-edit-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9624-C67H-J9C9
Vulnerability from github – Published: 2026-07-23 12:32 – Updated: 2026-07-23 12:32Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.
{
"affected": [],
"aliases": [
"CVE-2026-65463"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-23T12:18:38Z",
"severity": "MODERATE"
},
"details": "Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS \u003c= 2.3.1 versions.",
"id": "GHSA-9624-c67h-j9c9",
"modified": "2026-07-23T12:32:28Z",
"published": "2026-07-23T12:32:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65463"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-3-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9672-4FH3-MCFG
Vulnerability from github – Published: 2022-11-10 12:01 – Updated: 2022-11-11 12:00Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.
{
"affected": [],
"aliases": [
"CVE-2022-3413"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-10T00:15:00Z",
"severity": "MODERATE"
},
"details": "Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project\u0027s Audit Events and Developers or Maintainers to view the group\u0027s Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.",
"id": "GHSA-9672-4fh3-mcfg",
"modified": "2022-11-11T12:00:29Z",
"published": "2022-11-10T12:01:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3413"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/374926"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-969H-R76Q-FXG7
Vulnerability from github – Published: 2026-08-11 18:31 – Updated: 2026-08-11 18:31Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
{
"affected": [],
"aliases": [
"CVE-2026-58650"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T17:18:05Z",
"severity": "HIGH"
},
"details": "Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.",
"id": "GHSA-969h-r76q-fxg7",
"modified": "2026-08-11T18:31:00Z",
"published": "2026-08-11T18:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58650"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58650"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-96C8-XGPW-CF29
Vulnerability from github – Published: 2022-05-13 01:48 – Updated: 2025-05-30 18:30An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization when listing the history of another user via a modified "vaultize_session_id" value in a cookie.
{
"affected": [],
"aliases": [
"CVE-2018-10211"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-25T18:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization when listing the history of another user via a modified \"vaultize_session_id\" value in a cookie.",
"id": "GHSA-96c8-xgpw-cf29",
"modified": "2025-05-30T18:30:33Z",
"published": "2022-05-13T01:48:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10211"
},
{
"type": "WEB",
"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-10211"
},
{
"type": "WEB",
"url": "https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10211"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-96CQ-CJ7W-27G2
Vulnerability from github – Published: 2023-04-05 21:30 – Updated: 2023-04-12 21:30An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group.
{
"affected": [],
"aliases": [
"CVE-2023-1417"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-05T21:15:00Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim\u0027s epic in an unrelated group.",
"id": "GHSA-96cq-cj7w-27g2",
"modified": "2023-04-12T21:30:21Z",
"published": "2023-04-05T21:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1417"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1892200"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1417.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/396720"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-96FH-FPRM-V973
Vulnerability from github – Published: 2026-10-16 06:30 – Updated: 2026-10-16 06:30The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.
{
"affected": [],
"aliases": [
"CVE-2026-103525"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T05:17:28Z",
"severity": "HIGH"
},
"details": "The FluentCart A New Era of eCommerce \u2013 Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the \u0027order_id + billing_address_id (also shipping_address_id)\u0027 parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer\u0027s stored billing and shipping address PII \u2014 including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID \u2014 by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.",
"id": "GHSA-96fh-fprm-v973",
"modified": "2026-10-16T06:30:25Z",
"published": "2026-10-16T06:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103525"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L124"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L338"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/api/Checkout/CheckoutApi.php#L369"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.7.0/app/Hooks/Cart/WebCheckoutHandler.php#L132"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3734886%40fluent-cart\u0026new=3734886%40fluent-cart"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8375a8f4-274d-4c4f-8833-067efc7e57a2?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-96WG-XPX4-3H59
Vulnerability from github – Published: 2026-08-11 03:31 – Updated: 2026-08-11 03:31Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data.
{
"affected": [],
"aliases": [
"CVE-2026-19424"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T03:17:36Z",
"severity": "HIGH"
},
"details": "Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users\u0027 sensitive data.",
"id": "GHSA-96wg-xpx4-3h59",
"modified": "2026-08-11T03:31:58Z",
"published": "2026-08-11T03:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19424"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-11097-ee412-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-11096-0f578-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-96X2-4759-FJJ4
Vulnerability from github – Published: 2026-10-16 18:34 – Updated: 2026-10-16 18:34Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.
{
"affected": [],
"aliases": [
"CVE-2026-111615"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T18:17:40Z",
"severity": "HIGH"
},
"details": "Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops\u0027 buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.",
"id": "GHSA-96x2-4759-fjj4",
"modified": "2026-10-16T18:34:43Z",
"published": "2026-10-16T18:34:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111615"
},
{
"type": "WEB",
"url": "https://github.com/gz-yami/mall4cloud/blob/v4.0/mall4cloud-order/src/main/java/com/mall4j/cloud/order/controller/multishop/OrderController.java#L75-L80"
},
{
"type": "WEB",
"url": "https://github.com/gz-yami/mall4cloud/blob/v4.0/mall4cloud-order/src/main/resources/mapper/OrderAddrMapper.xml#L27-L29"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/mall4cloud-multishop-order-addr-cross-shop-idor"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/mall4cloud-through-4.0-idor-exposing-buyer-addresses-via-order-addr-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.