CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5323 vulnerabilities reference this CWE, most recent first.
GHSA-HHMQ-2C6M-MGV4
Vulnerability from github – Published: 2024-03-12 15:32 – Updated: 2024-03-15 15:30An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user’s bookmark via URL manipulation.
{
"affected": [],
"aliases": [
"CVE-2024-23112"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-12T15:15:49Z",
"severity": "HIGH"
},
"details": "An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user\u2019s bookmark via URL manipulation.",
"id": "GHSA-hhmq-2c6m-mgv4",
"modified": "2024-03-15T15:30:42Z",
"published": "2024-03-12T15:32:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23112"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-24-013"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HHPX-68FP-4GM4
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2022-05-24 19:13An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people's personal information and images of their hunting/fishing licenses.
{
"affected": [],
"aliases": [
"CVE-2021-33981"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-08T17:15:00Z",
"severity": "MODERATE"
},
"details": "An insecure, direct object vulnerability in hunting/fishing license retrieval function of the \"Fish | Hunt FL\" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people\u0027s personal information and images of their hunting/fishing licenses.",
"id": "GHSA-hhpx-68fp-4gm4",
"modified": "2022-05-24T19:13:20Z",
"published": "2022-05-24T19:13:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33981"
},
{
"type": "WEB",
"url": "https://gist.github.com/p4lsec/1f024d96b44ea733cdae0605c7ce8a49"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HHR3-P57F-P83G
Vulnerability from github – Published: 2025-10-08 15:32 – Updated: 2025-10-08 15:32Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain unauthorized access to NFSv4 or SMB shares.
{
"affected": [],
"aliases": [
"CVE-2025-43724"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-08T15:16:23Z",
"severity": "MODERATE"
},
"details": "Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain unauthorized access to NFSv4 or SMB shares.",
"id": "GHSA-hhr3-p57f-p83g",
"modified": "2025-10-08T15:32:27Z",
"published": "2025-10-08T15:32:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43724"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000376214/dsa-2025-347-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HJ37-32JP-79FV
Vulnerability from github – Published: 2022-06-28 00:00 – Updated: 2022-07-08 00:00A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.
{
"affected": [],
"aliases": [
"CVE-2017-20101"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-27T14:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.",
"id": "GHSA-hj37-32jp-79fv",
"modified": "2022-07-08T00:00:51Z",
"published": "2022-06-28T00:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20101"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.97275"
},
{
"type": "WEB",
"url": "https://youtu.be/Xc6Jg9I7Pj4"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Feb/58"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HJ6R-7GMV-7MPH
Vulnerability from github – Published: 2026-09-16 15:31 – Updated: 2026-09-16 15:31zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing} path variables. Attackers can query arbitrary indices including sys_user to retrieve sensitive user records and password hashes without proper access controls.
{
"affected": [],
"aliases": [
"CVE-2026-92468"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T14:17:17Z",
"severity": "HIGH"
},
"details": "zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing} path variables. Attackers can query arbitrary indices including sys_user to retrieve sensitive user records and password hashes without proper access controls.",
"id": "GHSA-hj6r-7gmv-7mph",
"modified": "2026-09-16T15:31:12Z",
"published": "2026-09-16T15:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92468"
},
{
"type": "WEB",
"url": "https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C22_request_stat_agg.py"
},
{
"type": "WEB",
"url": "https://github.com/LinYuanyi1/cve-request-poc/blob/master/microservice-platform/C24_search_any_index.py"
},
{
"type": "WEB",
"url": "https://github.com/zlt2000/microservices-platform"
},
{
"type": "WEB",
"url": "https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-business/search-center/search-server/src/main/java/com/central/search/controller/AggregationController.java#L33"
},
{
"type": "WEB",
"url": "https://github.com/zlt2000/microservices-platform/blob/v6.0.0/zlt-business/search-center/search-server/src/main/java/com/central/search/controller/SearchController.java#L36"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/microservices-platform-through-6.0.0-arbitrary-elasticsearch-index-read-via-search-center"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HJ78-P4H7-M5FV
Vulnerability from github – Published: 2025-01-28 19:15 – Updated: 2025-03-17 20:23Problem Description
A vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can only be exploited if the following requirements are met:
- An attacker can anticipate the email address of the user.
- An attacker can register a public frontend user account using that email address before the user's first OIDC login.
- The IDP returns the field email containing the email address of the user
Solution
An updated versions 4.0.0 is available from the TYPO3 extension manager, packagist and at https://extensions.typo3.org/extension/download/oidc/4.0.0/zip
Users of the extension are advised to update the extension as soon as possible.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "causal/oidc"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "4.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-24856"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-348",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-28T19:15:44Z",
"nvd_published_at": "2025-03-16T04:15:14Z",
"severity": "MODERATE"
},
"details": "## Problem Description\nA vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can only be exploited if the following requirements are met:\n\n- An attacker can anticipate the email address of the user.\n- An attacker can register a public frontend user account using that email address before the user\u0027s first OIDC login.\n- The IDP returns the field email containing the email address of the user\n\n## Solution\nAn updated versions 4.0.0 is available from the TYPO3 extension manager, packagist and at \nhttps://extensions.typo3.org/extension/download/oidc/4.0.0/zip\n\nUsers of the extension are advised to update the extension as soon as possible.",
"id": "GHSA-hj78-p4h7-m5fv",
"modified": "2025-03-17T20:23:43Z",
"published": "2025-01-28T19:15:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24856"
},
{
"type": "WEB",
"url": "https://github.com/xperseguers/t3ext-oidc/commit/877e09f6faf4c87bbb41233112ec7e30d3c902b3"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/causal/oidc/CVE-2025-24856.yaml"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2025-001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "TYPO3-EXT-SA-2025-001: Account Takeover in extension \"OpenID Connect Authentication\" (oidc)"
}
GHSA-HJ83-C8Q3-6FC2
Vulnerability from github – Published: 2024-03-13 18:31 – Updated: 2024-03-13 18:31The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient user validation on the bitforms_update_form_entry AJAX action in all versions up to, and including, 2.10.1. This makes it possible for unauthenticated attackers to modify form submissions.
{
"affected": [],
"aliases": [
"CVE-2024-1640"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-13T16:15:24Z",
"severity": "MODERATE"
},
"details": "The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient user validation on the bitforms_update_form_entry AJAX action in all versions up to, and including, 2.10.1. This makes it possible for unauthenticated attackers to modify form submissions.",
"id": "GHSA-hj83-c8q3-6fc2",
"modified": "2024-03-13T18:31:33Z",
"published": "2024-03-13T18:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1640"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3048523/bit-form/trunk/includes/Frontend/Ajax/FrontendAjax.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/49ed7d6a-4a65-4efc-90e5-ffa5470d4011?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HJG6-2C9H-3RGP
Vulnerability from github – Published: 2026-05-14 15:31 – Updated: 2026-05-14 15:31Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System allows Exploitation of Trusted Identifiers.
This issue affects Library Automation System: from v.21.6 before v.22.1.
{
"affected": [],
"aliases": [
"CVE-2025-15025"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-14T14:16:15Z",
"severity": "HIGH"
},
"details": "Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System allows Exploitation of Trusted Identifiers.\n\nThis issue affects Library Automation System: from v.21.6 before v.22.1.",
"id": "GHSA-hjg6-2c9h-3rgp",
"modified": "2026-05-14T15:31:58Z",
"published": "2026-05-14T15:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15025"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0240"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HJHX-MR4R-6J6J
Vulnerability from github – Published: 2024-11-04 15:31 – Updated: 2024-11-22 12:39This vulnerability exists in the Wave 2.0 due to missing authorization check on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter “user_id” through API request URLs which could lead to unauthorized creation, modification and deletion of alerts belonging to other user accounts.
{
"affected": [],
"aliases": [
"CVE-2024-51559"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-04T13:17:05Z",
"severity": "HIGH"
},
"details": "This vulnerability exists in the Wave 2.0\u00a0due\u00a0to missing authorization check on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter \u201cuser_id\u201d through API request URLs which could lead to unauthorized creation, modification and deletion of alerts belonging to other user accounts.",
"id": "GHSA-hjhx-mr4r-6j6j",
"modified": "2024-11-22T12:39:08Z",
"published": "2024-11-04T15:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51559"
},
{
"type": "WEB",
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2024-0332"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HJP7-X3QV-VQF3
Vulnerability from github – Published: 2026-07-21 18:31 – Updated: 2026-07-21 18:31SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.
{
"affected": [],
"aliases": [
"CVE-2026-28308"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T16:17:08Z",
"severity": "CRITICAL"
},
"details": "SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.",
"id": "GHSA-hjp7-x3qv-vqf3",
"modified": "2026-07-21T18:31:00Z",
"published": "2026-07-21T18:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28308"
},
{
"type": "WEB",
"url": "https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28308"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.