Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5346 vulnerabilities reference this CWE, most recent first.
GHSA-GHJ7-F59X-5HW6
Vulnerability from github – Published: 2026-10-16 00:31 – Updated: 2026-10-16 00:31
VLAI
Details
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-111366"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-15T22:19:34Z",
"severity": "HIGH"
},
"details": "cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.",
"id": "GHSA-ghj7-f59x-5hw6",
"modified": "2026-10-16T00:31:59Z",
"published": "2026-10-16T00:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111366"
},
{
"type": "WEB",
"url": "https://github.com/cool-team-official/cool-admin-midway"
},
{
"type": "WEB",
"url": "https://github.com/cool-team-official/cool-admin-midway/blob/e545ef6f3b0c08581e34bd3207ca57d851ccc3ae/src/modules/base/service/sys/user.ts#L205-L229"
},
{
"type": "WEB",
"url": "https://github.com/cool-team-official/cool-admin-midway/blob/e545ef6f3b0c08581e34bd3207ca57d851ccc3ae/src/modules/base/service/sys/user.ts#L41-L70"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/cool-admin-midway-base-crud-role-ownership-idor"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/cool-admin-midway-through-8.0.0-authorization-bypass-via-admin-sys-user-endpoints"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GHMQ-XXC8-J8M5
Vulnerability from github – Published: 2026-10-16 18:34 – Updated: 2026-10-16 18:34
VLAI
Details
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-111707"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T18:17:54Z",
"severity": "MODERATE"
},
"details": "99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users\u0027 chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users\u0027 message content and task data.",
"id": "GHSA-ghmq-xxc8-j8m5",
"modified": "2026-10-16T18:34:55Z",
"published": "2026-10-16T18:34:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111707"
},
{
"type": "WEB",
"url": "https://github.com/vastxie/99AI"
},
{
"type": "WEB",
"url": "https://github.com/vastxie/99AI/blob/v4.3.0/service/src/common/auth/jwtAuth.guard.ts"
},
{
"type": "WEB",
"url": "https://github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts#L463-L475"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/99ai-through-4.3.0-idor-via-api-chatlog-querysinglechat-chat-message-disclosure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GHRQ-8GF7-VMRQ
Vulnerability from github – Published: 2026-09-09 12:32 – Updated: 2026-09-09 12:32
VLAI
Details
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents containing embed queries that select those blocks.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-87809"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T12:17:15Z",
"severity": "HIGH"
},
"details": "Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents containing embed queries that select those blocks.",
"id": "GHSA-ghrq-8gf7-vmrq",
"modified": "2026-09-09T12:32:15Z",
"published": "2026-09-09T12:32:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8wx4-fvqw-f5f8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87809"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/siyuan-before-3.8.2-information-disclosure-via-export-preview"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GHRW-X6CV-MR95
Vulnerability from github – Published: 2023-09-27 15:30 – Updated: 2023-09-27 15:30
VLAI
Details
Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-44154"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-27T15:19:37Z",
"severity": "LOW"
},
"details": "Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.",
"id": "GHSA-ghrw-x6cv-mr95",
"modified": "2023-09-27T15:30:39Z",
"published": "2023-09-27T15:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44154"
},
{
"type": "WEB",
"url": "https://security-advisory.acronis.com/advisories/SEC-2436"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHW7-HV89-J7JQ
Vulnerability from github – Published: 2026-06-18 06:32 – Updated: 2026-06-18 06:32
VLAI
Details
The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.0 via the 'rule_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to modify or delete quiz rules belonging to other teachers, resulting in unauthorized tampering of another user's quiz structure.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-10623"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-18T06:16:56Z",
"severity": "MODERATE"
},
"details": "The PressPrimer Quiz \u2013 AI Quiz Maker, Exam Builder \u0026 LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.0 via the \u0027rule_id\u0027 parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to modify or delete quiz rules belonging to other teachers, resulting in unauthorized tampering of another user\u0027s quiz structure.",
"id": "GHSA-ghw7-hv89-j7jq",
"modified": "2026-06-18T06:32:20Z",
"published": "2026-06-18T06:32:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10623"
},
{
"type": "WEB",
"url": "https://github.com/PressPrimer/pressprimer-quiz/commit/1795687"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/150ac796-d77b-4915-8bbf-9f9b54be8eaf?source=cve"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.2.2/includes/api/class-ppq-rest-controller.php#L434"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.2.2/includes/api/class-ppq-rest-controller.php#L1963"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.2.2/includes/api/class-ppq-rest-controller.php#L1923"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.2.2/includes/api/class-ppq-rest-controller.php#L1860"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.2.2/includes/api/class-ppq-rest-controller.php#L1813"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.2.2/includes/api/class-ppq-rest-controller.php#L1786"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.2.2/includes/api/class-ppq-rest-controller.php#L1703"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.1.0/includes/api/class-ppq-rest-controller.php#L434"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.1.0/includes/api/class-ppq-rest-controller.php#L1963"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.1.0/includes/api/class-ppq-rest-controller.php#L1923"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.1.0/includes/api/class-ppq-rest-controller.php#L1860"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.1.0/includes/api/class-ppq-rest-controller.php#L1813"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.1.0/includes/api/class-ppq-rest-controller.php#L1786"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/pressprimer-quiz/tags/2.1.0/includes/api/class-ppq-rest-controller.php#L1703"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHXW-RGQV-5CP6
Vulnerability from github – Published: 2023-02-13 15:30 – Updated: 2023-02-23 06:30
VLAI
Details
The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-3891"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-13T15:15:00Z",
"severity": "MODERATE"
},
"details": "The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.",
"id": "GHSA-ghxw-rgqv-5cp6",
"modified": "2023-02-23T06:30:17Z",
"published": "2023-02-13T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3891"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/5a69965d-d243-4d51-b7a4-d6f4b199abf1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GJ26-GRCQ-VM8J
Vulnerability from github – Published: 2026-10-29 03:30 – Updated: 2026-10-29 03:30
VLAI
Details
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-66091"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-29T02:16:52Z",
"severity": "MODERATE"
},
"details": "In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user\u0027s uniqueId can retrieve that user\u0027s stored personal details (username, first name, last name and email address) within the same institution.",
"id": "GHSA-gj26-grcq-vm8j",
"modified": "2026-10-29T03:30:29Z",
"published": "2026-10-29T03:30:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openequella/openEQUELLA/security/advisories/GHSA-mxj9-pmpw-j4xw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66091"
},
{
"type": "WEB",
"url": "https://openequella.github.io/guides"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GJ37-5J8H-J367
Vulnerability from github – Published: 2026-08-01 15:30 – Updated: 2026-08-01 15:30
VLAI
Details
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-67331"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-01T13:17:03Z",
"severity": "HIGH"
},
"details": "better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users\u0027 providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.",
"id": "GHSA-gj37-5j8h-j367",
"modified": "2026-08-01T15:30:29Z",
"published": "2026-08-01T15:30:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67331"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/better-auth-scim-before-beta-4-authorization-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GJ7R-228J-689H
Vulnerability from github – Published: 2025-12-23 00:30 – Updated: 2025-12-23 00:30
VLAI
Details
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2023-53955"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-22T22:15:59Z",
"severity": "CRITICAL"
},
"details": "SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.",
"id": "GHSA-gj7r-228j-689h",
"modified": "2025-12-23T00:30:31Z",
"published": "2025-12-23T00:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53955"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20221207074555/https://www.sound4.com"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/51169"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-authorization-bypass-via-insecure-object-references"
},
{
"type": "WEB",
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GJ8Q-6WMR-V9MQ
Vulnerability from github – Published: 2026-08-01 15:30 – Updated: 2026-08-01 15:30
VLAI
Details
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-67342"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-01T13:17:05Z",
"severity": "CRITICAL"
},
"details": "ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions. Attackers can access and modify databases they are not authorized to use by directly calling affected endpoints with arbitrary database parameters.",
"id": "GHSA-gj8q-6wmr-v9mq",
"modified": "2026-08-01T15:30:29Z",
"published": "2026-08-01T15:30:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-x8mg-6r4p-87pf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67342"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/arcadedb-before-authorization-bypass-via-database-handlers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.