CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5363 vulnerabilities reference this CWE, most recent first.
GHSA-FP33-7F49-FWPM
Vulnerability from github – Published: 2026-09-22 00:30 – Updated: 2026-09-22 00:30lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.
{
"affected": [],
"aliases": [
"CVE-2026-94534"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-21T22:17:00Z",
"severity": "HIGH"
},
"details": "lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.",
"id": "GHSA-fp33-7f49-fwpm",
"modified": "2026-09-22T00:30:54Z",
"published": "2026-09-22T00:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94534"
},
{
"type": "WEB",
"url": "https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-03-anyone-baseinfo-write-bola.py"
},
{
"type": "WEB",
"url": "https://github.com/LinYuanyi1/cve-request-poc/blob/master/lamp/poc-06-anyone-avatar-write-bola.py"
},
{
"type": "WEB",
"url": "https://github.com/dromara/lamp-cloud"
},
{
"type": "WEB",
"url": "https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L128-L136"
},
{
"type": "WEB",
"url": "https://github.com/dromara/lamp-cloud/blob/bdc1a406eb0f6291e9f6dbad9cbccd67bc6a37b6/lamp-oauth/lamp-oauth-controller/src/main/java/top/tangyh/lamp/oauth/controller/UserInfoController.java#L68-L78"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.0-unauthorized-profile-modification-via-put-endpoints"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FP99-3RPW-VRXX
Vulnerability from github – Published: 2025-12-04 18:30 – Updated: 2025-12-08 18:30An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'rec_no' parameter in the /student/get-receipt endpoint.
{
"affected": [],
"aliases": [
"CVE-2025-61148"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-04T16:16:22Z",
"severity": "MODERATE"
},
"details": "An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the \u0027rec_no\u0027 parameter in the /student/get-receipt endpoint.",
"id": "GHSA-fp99-3rpw-vrxx",
"modified": "2025-12-08T18:30:25Z",
"published": "2025-12-04T18:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61148"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1BRZRurbl7TY6KU4uaelAUn7L9Cn6XfjC/view?usp=sharing"
},
{
"type": "WEB",
"url": "https://github.com/sharma19d/CVE-2025-61148"
},
{
"type": "WEB",
"url": "https://medium.com/@Charon19d/how-i-hacked-all-universities-in-my-city-d6b8e320455c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FP9C-2FXX-C9Q4
Vulnerability from github – Published: 2025-04-16 00:31 – Updated: 2025-04-16 00:31Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
{
"affected": [],
"aliases": [
"CVE-2025-31360"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-15T22:15:27Z",
"severity": "MODERATE"
},
"details": "Unauthenticated attackers can trigger device actions associated with specific \"scenes\" of arbitrary users.",
"id": "GHSA-fp9c-2fxx-c9q4",
"modified": "2025-04-16T00:31:38Z",
"published": "2025-04-16T00:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31360"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FPPF-7FVR-HR9C
Vulnerability from github – Published: 2026-10-19 15:32 – Updated: 2026-10-19 15:32Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.
{
"affected": [],
"aliases": [
"CVE-2026-112286"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-19T14:17:06Z",
"severity": "HIGH"
},
"details": "Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users\u0027 quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.",
"id": "GHSA-fppf-7fvr-hr9c",
"modified": "2026-10-19T15:32:41Z",
"published": "2026-10-19T15:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112286"
},
{
"type": "WEB",
"url": "https://github.com/krayin/laravel-crm/pull/2683"
},
{
"type": "WEB",
"url": "https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28"
},
{
"type": "WEB",
"url": "https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Http/Controllers/Quote/QuoteController.php"
},
{
"type": "WEB",
"url": "https://github.com/krayin/laravel-crm/releases/tag/v2.2.7"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/krayin-crm-before-2.2.7-idor-via-quote-search-and-lead-products-endpoints"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FPQ2-6XQ4-6XM4
Vulnerability from github – Published: 2026-09-10 09:31 – Updated: 2026-09-10 09:31An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.
{
"affected": [],
"aliases": [
"CVE-2026-82582"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-10T07:17:03Z",
"severity": "MODERATE"
},
"details": "An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware\u0027s shared file feature.",
"id": "GHSA-fpq2-6xq4-6xm4",
"modified": "2026-09-10T09:31:32Z",
"published": "2026-09-10T09:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82582"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN37476837"
},
{
"type": "WEB",
"url": "https://www.ss-proj.org/support/1710.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FPVF-FVP5-996R
Vulnerability from github – Published: 2026-03-11 00:24 – Updated: 2026-03-11 05:47Description
A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks.
The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes).
Impact
An attacker can modify domain configurations for content nodes they are not permitted to edit. This may result in malicious or unintended routing behaviour, service disruption, and potential disclosure of configuration-related information.
Patches
The issue is patched in 16.5.1 and 17.2.2.
Workarounds
There is no workaround other than upgrading.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Umbraco.Cms"
},
"ranges": [
{
"events": [
{
"introduced": "14.0.0"
},
{
"fixed": "16.5.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Umbraco.Cms"
},
"ranges": [
{
"events": [
{
"introduced": "17.0.0"
},
{
"fixed": "17.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-31832"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-11T00:24:53Z",
"nvd_published_at": "2026-03-10T22:16:21Z",
"severity": "MODERATE"
},
"details": "### Description\nA broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks.\n\nThe issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes).\n\n### Impact\nAn attacker can modify domain configurations for content nodes they are not permitted to edit. This may result in malicious or unintended routing behaviour, service disruption, and potential disclosure of configuration-related information.\n\n### Patches\nThe issue is patched in 16.5.1 and 17.2.2.\n\n### Workarounds\nThere is no workaround other than upgrading.",
"id": "GHSA-fpvf-fvp5-996r",
"modified": "2026-03-11T05:47:21Z",
"published": "2026-03-11T00:24:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fpvf-fvp5-996r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31832"
},
{
"type": "PACKAGE",
"url": "https://github.com/umbraco/Umbraco-CMS"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Umbraco Backoffice API Allows Unauthorized Modification of Domain Data"
}
GHSA-FPWW-C55P-CJV6
Vulnerability from github – Published: 2026-10-06 16:09 – Updated: 2026-10-06 16:09Impact
A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens.
You are affected if:
- You use an affected Payload version.
- Users can query a collection with a polymorphic join to sensitive fields.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
There is no complete workaround. Restricting read access to sensitive collections reduces exposure but does not replace upgrading.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "payload"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.90.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "payload"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-canary.0"
},
{
"fixed": "4.0.0-canary.34"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-105847"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-06T16:09:04Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nA user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens.\n\nYou are affected if:\n\n- You use an affected Payload version.\n- Users can query a collection with a polymorphic join to sensitive fields.\n\n### Patches\n\nUsers should upgrade Payload packages to `\u003e= 3.90.0` or `\u003e= 4.0.0-canary.34`.\n\n### Workarounds\n\nThere is no complete workaround. Restricting read access to sensitive collections reduces exposure but does not replace upgrading.",
"id": "GHSA-fpww-c55p-cjv6",
"modified": "2026-10-06T16:09:04Z",
"published": "2026-10-06T16:09:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-fpww-c55p-cjv6"
},
{
"type": "WEB",
"url": "https://github.com/payloadcms/payload/commit/caa3f69b5aecc6e7c2b459ed87972cbca9f33ee5"
},
{
"type": "PACKAGE",
"url": "https://github.com/payloadcms/payload"
},
{
"type": "WEB",
"url": "https://github.com/payloadcms/payload/releases/tag/v3.90.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Payload: Polymorphic join queries could disclose hidden fields"
}
GHSA-FQ22-X2C4-X739
Vulnerability from github – Published: 2026-10-21 06:31 – Updated: 2026-10-21 12:31The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their original listings and URLs.
{
"affected": [],
"aliases": [
"CVE-2026-110514"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-21T06:16:47Z",
"severity": "MODERATE"
},
"details": "The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user\u0027s posts and pages into portfolio items, removing them from their original listings and URLs.",
"id": "GHSA-fq22-x2c4-x739",
"modified": "2026-10-21T12:31:04Z",
"published": "2026-10-21T06:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110514"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/a6d3be6f-2203-4bc3-9f65-4eba2e9d2bc4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FQ3V-MC83-WVWC
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the get_item_permissions_check method granting access to users with the ssa_manage_appointments capability without validating staff ownership of the requested appointment. This makes it possible for authenticated attackers, with custom-level access and above (users granted the ssa_manage_appointments capability, such as Team Members), to view appointment records belonging to other staff members and access sensitive customer personally identifiable information via the appointment ID parameter.
{
"affected": [],
"aliases": [
"CVE-2026-1704"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:53:58Z",
"severity": "MODERATE"
},
"details": "The Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the `get_item_permissions_check` method granting access to users with the `ssa_manage_appointments` capability without validating staff ownership of the requested appointment. This makes it possible for authenticated attackers, with custom-level access and above (users granted the ssa_manage_appointments capability, such as Team Members), to view appointment records belonging to other staff members and access sensitive customer personally identifiable information via the appointment ID parameter.",
"id": "GHSA-fq3v-mc83-wvwc",
"modified": "2026-03-13T21:31:46Z",
"published": "2026-03-13T21:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1704"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-appointment-model.php#L1348"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-appointment-model.php#L1436"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php#L1348"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php#L1436"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3480506%40simply-schedule-appointments%2Ftrunk\u0026old=3475885%40simply-schedule-appointments%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c82f3864-13af-4ff6-824a-4c799a98f3f6?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FQ8V-WJFJ-2725
Vulnerability from github – Published: 2025-02-05 15:32 – Updated: 2025-10-22 21:31ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.
{
"affected": [],
"aliases": [
"CVE-2024-9097"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T13:15:23Z",
"severity": "LOW"
},
"details": "ManageEngine Endpoint Central versions before\u00a011.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.",
"id": "GHSA-fq8v-wjfj-2725",
"modified": "2025-10-22T21:31:16Z",
"published": "2025-02-05T15:32:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9097"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/desktop-central/cve-2024-9097.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.