CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5368 vulnerabilities reference this CWE, most recent first.
GHSA-CXJV-QHFQ-QM94
Vulnerability from github – Published: 2026-10-01 12:31 – Updated: 2026-10-01 12:31In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
{
"affected": [],
"aliases": [
"CVE-2026-103491"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-01T10:17:14Z",
"severity": "MODERATE"
},
"details": "In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues",
"id": "GHSA-cxjv-qhfq-qm94",
"modified": "2026-10-01T12:31:12Z",
"published": "2026-10-01T12:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103491"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CXPF-JM7W-39V7
Vulnerability from github – Published: 2026-09-16 15:31 – Updated: 2026-09-16 15:31TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.
{
"affected": [],
"aliases": [
"CVE-2026-92567"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T15:19:02Z",
"severity": "HIGH"
},
"details": "TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users\u0027 form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.",
"id": "GHSA-cxpf-jm7w-39v7",
"modified": "2026-09-16T15:31:14Z",
"published": "2026-09-16T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92567"
},
{
"type": "WEB",
"url": "https://github.com/TDuckCloud/tduck-survey-form/issues/39"
},
{
"type": "WEB",
"url": "https://github.com/TDuckCloud/tduck-survey-form"
},
{
"type": "WEB",
"url": "https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java#L198-L207"
},
{
"type": "WEB",
"url": "https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormDataServiceImpl.java#L158-L167"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/tduck-survey-form-through-5.0-unauthorized-data-modification"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CXPG-8FRP-CV2X
Vulnerability from github – Published: 2024-12-31 03:30 – Updated: 2024-12-31 03:30The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2024-13040"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-31T02:15:06Z",
"severity": "HIGH"
},
"details": "The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user\u0027s account information and privileges, leading to privilege escalation.",
"id": "GHSA-cxpg-8frp-cv2x",
"modified": "2024-12-31T03:30:33Z",
"published": "2024-12-31T03:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13040"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-8337-7899f-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-8336-aa03b-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CXR4-643W-MFV3
Vulnerability from github – Published: 2024-11-15 18:30 – Updated: 2024-11-22 04:25java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter.
{
"affected": [],
"aliases": [
"CVE-2024-50651"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T16:15:36Z",
"severity": "MODERATE"
},
"details": "java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter.",
"id": "GHSA-cxr4-643w-mfv3",
"modified": "2024-11-22T04:25:02Z",
"published": "2024-11-15T18:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50651"
},
{
"type": "WEB",
"url": "https://github.com/Yllxx03/CVE/blob/main/java_shop/BrokenAccessControl.md"
},
{
"type": "WEB",
"url": "https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50651"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CXVF-WCRG-RCP2
Vulnerability from github – Published: 2026-08-27 00:30 – Updated: 2026-08-27 00:30Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases.
{
"affected": [],
"aliases": [
"CVE-2026-65642"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-26T22:16:25Z",
"severity": "HIGH"
},
"details": "Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers\u0027 databases.",
"id": "GHSA-cxvf-wcrg-rcp2",
"modified": "2026-08-27T00:30:28Z",
"published": "2026-08-27T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65642"
},
{
"type": "WEB",
"url": "https://support.plesk.com/hc/en-us/articles/42844242102679-Vulnerability-CVE-2026-65642-in-Plesk-s-database-management-interface"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F25R-2J92-5MQM
Vulnerability from github – Published: 2026-01-22 18:30 – Updated: 2026-01-27 21:31Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cocco: from n/a through <= 1.5.1.
{
"affected": [],
"aliases": [
"CVE-2026-22391"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-22T17:16:32Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cocco: from n/a through \u003c= 1.5.1.",
"id": "GHSA-f25r-2j92-5mqm",
"modified": "2026-01-27T21:31:43Z",
"published": "2026-01-22T18:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22391"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Theme/cocco/vulnerability/wordpress-cocco-theme-1-5-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F28X-5FX8-2J2H
Vulnerability from github – Published: 2022-04-17 00:00 – Updated: 2025-12-19 21:30Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator) to export the user options of any user, even ones with higher privileges (like Global Administrators) than the current user. The exported XML contains every option of the exported user (even the hashed password).
{
"affected": [],
"aliases": [
"CVE-2022-29287"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-16T00:15:00Z",
"severity": "MODERATE"
},
"details": "Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator) to export the user options of any user, even ones with higher privileges (like Global Administrators) than the current user. The exported XML contains every option of the exported user (even the hashed password).",
"id": "GHSA-f28x-5fx8-2j2h",
"modified": "2025-12-19T21:30:14Z",
"published": "2022-04-17T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29287"
},
{
"type": "WEB",
"url": "https://devnet.kentico.com/download/hotfixes"
},
{
"type": "WEB",
"url": "https://www.offensity.com/en/blog/authenticated-insecure-direct-object-reference-in-kentico-cms-cve-outstanding"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F2C7-68F9-CHV5
Vulnerability from github – Published: 2026-09-08 18:31 – Updated: 2026-09-08 18:31AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another user's stored access_token and refresh_token, then delete the compromised record to destroy the victim's provider linkage.
{
"affected": [],
"aliases": [
"CVE-2026-86725"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T16:18:33Z",
"severity": "HIGH"
},
"details": "AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin\u0027s add.json.php endpoint that allows authenticated users to modify other users\u0027 OAuth token records. Attackers can supply arbitrary row IDs to overwrite another user\u0027s stored access_token and refresh_token, then delete the compromised record to destroy the victim\u0027s provider linkage.",
"id": "GHSA-f2c7-68f9-chv5",
"modified": "2026-09-08T18:31:53Z",
"published": "2026-09-08T18:31:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-rp73-gjpj-w92v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86725"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/avideo-socialmediapublisher-missing-authorization-via-add-json-php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F2F6-FWW5-GH59
Vulnerability from github – Published: 2026-09-23 06:31 – Updated: 2026-09-23 12:31The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
{
"affected": [],
"aliases": [
"CVE-2026-91025"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-23T06:17:05Z",
"severity": "MODERATE"
},
"details": "The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user\u0027s Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user\u0027s own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21\u0027s per-user settings on arbitrary users, including administrators.",
"id": "GHSA-f2f6-fww5-gh59",
"modified": "2026-09-23T12:31:11Z",
"published": "2026-09-23T06:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91025"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/6e010e3e-78e8-4bfc-b880-d9a85cff2c2a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F2GQ-2GR7-RJJC
Vulnerability from github – Published: 2026-10-22 12:31 – Updated: 2026-10-22 12:31Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
{
"affected": [],
"aliases": [
"CVE-2026-115325"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-22T11:17:51Z",
"severity": "HIGH"
},
"details": "Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.",
"id": "GHSA-f2gq-2gr7-rjjc",
"modified": "2026-10-22T12:31:17Z",
"published": "2026-10-22T12:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115325"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/issues/3875"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/pull/4153"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/commit/332d8b9bab030ee65e78b9141259e4e0e80ac4b0"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/blob/v1.7.0/controllers/ext_client.go#L879"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/netmaker-through-1.7.0-authorization-bypass-via-updateextclient-unscoped-lookup"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.