CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5421 vulnerabilities reference this CWE, most recent first.
GHSA-9X9F-F428-FF8P
Vulnerability from github – Published: 2026-09-22 09:31 – Updated: 2026-09-22 09:31The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.
{
"affected": [],
"aliases": [
"CVE-2026-18439"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-22T08:16:39Z",
"severity": "MODERATE"
},
"details": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload[\u0027ID\u0027], but the nested identifiers are passed straight into $wpdb-\u003eupdate/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.",
"id": "GHSA-9x9f-f428-ff8p",
"modified": "2026-09-22T09:31:12Z",
"published": "2026-09-22T09:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18439"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.10/classes/QuizBuilder.php#L156"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.10/classes/QuizBuilder.php#L291"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.10/classes/QuizBuilder.php#L423"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.10/classes/QuizBuilder.php#L430"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.10/classes/QuizBuilder.php#L781"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.3/classes/QuizBuilder.php#L156"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.3/classes/QuizBuilder.php#L291"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.3/classes/QuizBuilder.php#L423"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.3/classes/QuizBuilder.php#L430"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.3/classes/QuizBuilder.php#L781"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3690454/tutor/tags/4.0.8/classes/QuizBuilder.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d07c82d-262a-4ac1-9ee5-7ef4d025f66f?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9XVX-2953-C58G
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.
{
"affected": [],
"aliases": [
"CVE-2024-7476"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:36Z",
"severity": "MODERATE"
},
"details": "A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user\u0027s templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.",
"id": "GHSA-9xvx-2953-c58g",
"modified": "2025-03-20T12:32:46Z",
"published": "2025-03-20T12:32:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7476"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/183761f7-d411-4332-af86-2ccfbcc5bd9f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9XWC-VWWW-QQMW
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-10-09 20:43Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-32r8-5843-4qw2. This link is maintained to preserve external references.
Original Description
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "code.vikunja.io/api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-09T20:43:21Z",
"nvd_published_at": "2026-08-19T14:17:47Z",
"severity": "HIGH"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-32r8-5843-4qw2. This link is maintained to preserve external references.\n\n### Original Description\nVikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.",
"id": "GHSA-9xwc-vwww-qqmw",
"modified": "2026-10-09T20:43:21Z",
"published": "2026-08-19T15:32:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-32r8-5843-4qw2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76216"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/vikunja-through-principal-type-confusion-via-linksharing"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure",
"withdrawn": "2026-10-09T20:43:21Z"
}
GHSA-9XWF-RJXQ-33W5
Vulnerability from github – Published: 2026-09-12 15:31 – Updated: 2026-09-12 15:31WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with canStream privileges or no authentication can retrieve schedule names, descriptions, timestamps, and playlist identifiers by querying these endpoints without ownership checks.
{
"affected": [],
"aliases": [
"CVE-2026-90552"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-12T13:16:53Z",
"severity": "MODERATE"
},
"details": "WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with canStream privileges or no authentication can retrieve schedule names, descriptions, timestamps, and playlist identifiers by querying these endpoints without ownership checks.",
"id": "GHSA-9xwf-rjxq-33w5",
"modified": "2026-09-12T15:31:50Z",
"published": "2026-09-12T15:31:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-f4q2-49rm-rxh7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90552"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/wwbn-avideo-missing-authorization-via-playlists-schedules-list-json-php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9XWG-HW64-86P3
Vulnerability from github – Published: 2024-12-04 12:31 – Updated: 2024-12-04 12:31The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created by Elementor that they should not have access to.
{
"affected": [],
"aliases": [
"CVE-2024-10787"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-04T09:15:04Z",
"severity": "MODERATE"
},
"details": "The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the \u0027elementor-template\u0027 shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created by Elementor that they should not have access to.",
"id": "GHSA-9xwg-hw64-86p3",
"modified": "2024-12-04T12:31:44Z",
"published": "2024-12-04T12:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10787"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3198563%40lastudio-element-kit\u0026new=3198563%40lastudio-element-kit\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e63c0fb-7fe7-42f7-8fa9-ec159d3c8117?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C23H-4967-RHXW
Vulnerability from github – Published: 2026-10-11 00:30 – Updated: 2026-10-11 00:30JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one per request.
{
"affected": [],
"aliases": [
"CVE-2026-108608"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-10T22:16:34Z",
"severity": "MODERATE"
},
"details": "JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users\u0027 AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims\u0027 text-to-speech history entries stored in Redis, one per request.",
"id": "GHSA-c23h-4967-rhxw",
"modified": "2026-10-11T00:30:51Z",
"published": "2026-10-11T00:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108608"
},
{
"type": "WEB",
"url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_voice_record_delete.py"
},
{
"type": "WEB",
"url": "https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/voice/controller/VoiceController.java#L83-L90"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-idor-via-deletevoicerecord-userid-parameter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C273-C6VG-4PV5
Vulnerability from github – Published: 2022-05-24 00:01 – Updated: 2023-08-25 22:03A low-privileged user can modify and delete admin articles by changing the value of the article[id] parameter prior to 9.2.9.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "publify_core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.2.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-1810"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639",
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-02T20:38:50Z",
"nvd_published_at": "2022-05-23T12:16:00Z",
"severity": "MODERATE"
},
"details": "A low-privileged user can modify and delete admin articles by changing the value of the `article[id]` parameter prior to 9.2.9.",
"id": "GHSA-c273-c6vg-4pv5",
"modified": "2023-08-25T22:03:08Z",
"published": "2022-05-24T00:01:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1810"
},
{
"type": "WEB",
"url": "https://github.com/publify/publify/commit/c0aba87844d1e47da50c0d99a3465164a4d244ce"
},
{
"type": "PACKAGE",
"url": "https://github.com/publify/publify"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/publify_core/CVE-2022-1810.yml"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/9b2d7579-032e-42da-b736-4b10a868eacb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Publify has Improper Access Controls"
}
GHSA-C275-Q2J8-WWG9
Vulnerability from github – Published: 2026-08-24 21:33 – Updated: 2026-08-24 21:33Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response.
{
"affected": [],
"aliases": [
"CVE-2026-71505"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-24T19:16:49Z",
"severity": "HIGH"
},
"details": "Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company\u0027s WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim\u0027s previous password verifier from the API response.",
"id": "GHSA-c275-q2j8-wwg9",
"modified": "2026-08-24T21:33:41Z",
"published": "2026-08-24T21:33:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71505"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/4cf305ebb958eeffa921aad7c94de179b764f7e7"
},
{
"type": "WEB",
"url": "https://codeant.ai/security-research/cve-2026-71505-dolibarr-bola-enables-portal-account-takeover"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/dolibarr-rest-api-broken-object-level-authorization-via-third-party-write-route"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C29F-JM2C-8VV7
Vulnerability from github – Published: 2023-04-24 21:30 – Updated: 2024-04-04 03:39The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.
{
"affected": [],
"aliases": [
"CVE-2023-1129"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-24T19:15:09Z",
"severity": "MODERATE"
},
"details": "The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.",
"id": "GHSA-c29f-jm2c-8vv7",
"modified": "2024-04-04T03:39:59Z",
"published": "2023-04-24T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1129"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/d40479de-fb04-41b8-9fb0-41b9eefbd8af"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C29H-3PP8-76HF
Vulnerability from github – Published: 2026-02-20 18:31 – Updated: 2026-02-25 21:31Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiprocket: from n/a through <= 2.0.8.
{
"affected": [],
"aliases": [
"CVE-2025-68051"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-20T16:22:09Z",
"severity": "HIGH"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiprocket: from n/a through \u003c= 2.0.8.",
"id": "GHSA-c29h-3pp8-76hf",
"modified": "2026-02-25T21:31:17Z",
"published": "2026-02-20T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68051"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/shiprocket/vulnerability/wordpress-shiprocket-plugin-2-0-8-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.