CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5323 vulnerabilities reference this CWE, most recent first.
GHSA-HPVJ-R322-49WR
Vulnerability from github – Published: 2026-09-30 15:31 – Updated: 2026-09-30 15:31Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.
{
"affected": [],
"aliases": [
"CVE-2026-62081"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-30T13:17:19Z",
"severity": "MODERATE"
},
"details": "Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons \u003c= 1.14.11 versions.",
"id": "GHSA-hpvj-r322-49wr",
"modified": "2026-09-30T15:31:25Z",
"published": "2026-09-30T15:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62081"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/flexible-coupons/vulnerability/wordpress-flexible-pdf-coupons-plugin-1-14-11-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-HPXP-RX7C-457J
Vulnerability from github – Published: 2026-04-09 00:32 – Updated: 2026-08-27 21:31Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
{
"affected": [],
"aliases": [
"CVE-2026-4398"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T23:16:59Z",
"severity": "MODERATE"
},
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
"id": "GHSA-hpxp-rx7c-457j",
"modified": "2026-08-27T21:31:13Z",
"published": "2026-04-09T00:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4398"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3549150"
},
{
"type": "WEB",
"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/600360"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPXV-VPFV-7JC9
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-02-12 11:46An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-7854"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-17T21:02:25Z",
"nvd_published_at": "2019-08-02T22:15:00Z",
"severity": "HIGH"
},
"details": "An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.",
"id": "GHSA-hpxv-vpfv-7jc9",
"modified": "2024-02-12T11:46:52Z",
"published": "2022-05-24T16:52:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7854"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7854.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/magento/magento2"
},
{
"type": "WEB",
"url": "https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Magento 2 Community Edition IDOR Vulnerability"
}
GHSA-HQ3M-89XX-6G67
Vulnerability from github – Published: 2026-10-01 15:30 – Updated: 2026-10-01 15:30Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.
{
"affected": [],
"aliases": [
"CVE-2026-100514"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-01T15:17:17Z",
"severity": "HIGH"
},
"details": "Unauthenticated Insecure Direct Object References (IDOR) in REST API Log \u003c= 1.7.2 versions.",
"id": "GHSA-hq3m-89xx-6g67",
"modified": "2026-10-01T15:30:41Z",
"published": "2026-10-01T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100514"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-rest-api-log/vulnerability/wordpress-rest-api-log-plugin-1-7-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HQ4H-W933-JM6C
Vulnerability from github – Published: 2024-12-30 16:12 – Updated: 2024-12-30 18:43Summary
An Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request.
Details
The vulnerability exists in the subscription endpoint at /api/subscription. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription.
Vulnerable code in /api/subscription:
@subscription_router.patch("")
@requires(["authenticated"])
async def update_subscription(request: Request, email: str, operation: str):
# IDOR: email parameter directly references user subscriptions without ownership verification
customers = stripe.Customer.list(email=email).auto_paging_iter()
customer = next(customers, None)
if operation == "cancel":
# Any authenticated user can modify any subscription referenced by email
customer_id = customer.id
for subscription in stripe.Subscription.list(customer=customer_id):
stripe.Subscription.modify(subscription.id, cancel_at_period_end=True)
PoC
- Create a customer account in stripe:
-
Customer A:
adventure8812@zeropath.com(attacker) -
Log in as any user.
-
Send this request:
PATCH /api/subscription?email=adventure8812@zeropath.com&operation=cancel HTTP/1.1
- The subscription for Customer A is successfully set to cancel.
Impact
High: Revenue loss via mass cancellation of subscriptions. Loss of customer trust by re-enabling subscriptions they had set to cancel.
Resolution
This was fixed in the following commit which limited subscription update operations to the authenticated user: https://github.com/khoj-ai/khoj/commit/47d3c8c23597900af708bdc60aced3ae5d2064c1. Support for arbitrarily presenting an email for update has been deprecated.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "khoj"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.29.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-52294"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-30T16:12:40Z",
"nvd_published_at": "2024-12-30T17:15:09Z",
"severity": "MODERATE"
},
"details": "### Summary\nAn Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users\u0027 Stripe subscriptions by simply modifying the email parameter in the request.\n\n### Details\nThe vulnerability exists in the subscription endpoint at `/api/subscription`. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription.\n\nVulnerable code in `/api/subscription`:\n```python\n@subscription_router.patch(\"\")\n@requires([\"authenticated\"])\nasync def update_subscription(request: Request, email: str, operation: str):\n # IDOR: email parameter directly references user subscriptions without ownership verification\n customers = stripe.Customer.list(email=email).auto_paging_iter()\n customer = next(customers, None)\n \n if operation == \"cancel\":\n # Any authenticated user can modify any subscription referenced by email\n customer_id = customer.id\n for subscription in stripe.Subscription.list(customer=customer_id):\n stripe.Subscription.modify(subscription.id, cancel_at_period_end=True)\n```\n\n### PoC\n1. Create a customer account in stripe:\n - Customer A: `adventure8812@zeropath.com` (attacker)\n\n2. Log in as any user.\n\n3. Send this request:\n```http\nPATCH /api/subscription?email=adventure8812@zeropath.com\u0026operation=cancel HTTP/1.1\n```\n\n4. The subscription for Customer A is successfully set to cancel.\n\n### Impact\nHigh:\nRevenue loss via mass cancellation of subscriptions.\nLoss of customer trust by re-enabling subscriptions they had set to cancel.\n\n### Resolution\n\nThis was fixed in the following commit which limited subscription update operations to the authenticated user: https://github.com/khoj-ai/khoj/commit/47d3c8c23597900af708bdc60aced3ae5d2064c1. Support for arbitrarily presenting an email for update has been deprecated.\n",
"id": "GHSA-hq4h-w933-jm6c",
"modified": "2024-12-30T18:43:16Z",
"published": "2024-12-30T16:12:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/khoj-ai/khoj/security/advisories/GHSA-hq4h-w933-jm6c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52294"
},
{
"type": "WEB",
"url": "https://github.com/khoj-ai/khoj/commit/47d3c8c23597900af708bdc60aced3ae5d2064c1"
},
{
"type": "PACKAGE",
"url": "https://github.com/khoj-ai/khoj"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "khoj has an IDOR in subscription management allows unauthorized subscription modifications"
}
GHSA-HQFM-F44V-GMX6
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10The bulletin function of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bulletin particular content.
{
"affected": [],
"aliases": [
"CVE-2021-37212"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-706"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-09T10:15:00Z",
"severity": "MODERATE"
},
"details": "The bulletin function of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bulletin particular content.",
"id": "GHSA-hqfm-f44v-gmx6",
"modified": "2022-05-24T19:10:28Z",
"published": "2022-05-24T19:10:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37212"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-4989-5d955-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HQG2-5GXQ-FJHC
Vulnerability from github – Published: 2025-08-21 15:30 – Updated: 2025-08-21 15:30Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.
{
"affected": [],
"aliases": [
"CVE-2025-55370"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-21T14:15:41Z",
"severity": "HIGH"
},
"details": "Incorrect access control in the component \\controller\\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.",
"id": "GHSA-hqg2-5gxq-fjhc",
"modified": "2025-08-21T15:30:35Z",
"published": "2025-08-21T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55370"
},
{
"type": "WEB",
"url": "https://github.com/cina666/CVE/blob/main/jshERP/%E8%B6%8A%E6%9D%83%E8%8E%B7%E5%8F%96%E4%BB%BB%E6%84%8F%E8%B4%A6%E5%8F%B7%E4%BF%A1%E6%81%AF%E5%AE%9E%E7%8E%B0%E4%BB%BB%E6%84%8F%E7%99%BB%E5%BD%95.md"
},
{
"type": "WEB",
"url": "https://github.com/jishenghua/jshERP"
},
{
"type": "WEB",
"url": "http://jsherp.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HQP5-P5MJ-5P69
Vulnerability from github – Published: 2026-10-21 06:31 – Updated: 2026-10-21 12:31The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
{
"affected": [],
"aliases": [
"CVE-2026-105257"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-21T06:16:45Z",
"severity": "LOW"
},
"details": "The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer\u0027s record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.",
"id": "GHSA-hqp5-p5mj-5p69",
"modified": "2026-10-21T12:31:04Z",
"published": "2026-10-21T06:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105257"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/10a8f09f-8282-456d-ad07-7e594e70a371"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HQV6-JG73-3GMV
Vulnerability from github – Published: 2026-10-21 15:42 – Updated: 2026-10-21 15:42Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.
{
"affected": [],
"aliases": [
"CVE-2026-114393"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-21T13:18:29Z",
"severity": "MODERATE"
},
"details": "Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.",
"id": "GHSA-hqv6-jg73-3gmv",
"modified": "2026-10-21T15:42:27Z",
"published": "2026-10-21T15:42:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114393"
},
{
"type": "WEB",
"url": "https://github.com/polonel/trudesk"
},
{
"type": "WEB",
"url": "https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/tickets.js#L767-L883"
},
{
"type": "WEB",
"url": "https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v2/tickets.js#L167-L197"
},
{
"type": "WEB",
"url": "https://hackmd.io/@leediay/multiple-vuln-trudesk-1211"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/trudesk-through-1.2.11-authorization-bypass-via-ticket-update-api-endpoints"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HQV9-X7QP-69HR
Vulnerability from github – Published: 2026-07-29 09:31 – Updated: 2026-07-29 15:31The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin through 3.12.26 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.
{
"affected": [],
"aliases": [
"CVE-2026-14224"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-29T07:16:41Z",
"severity": "MODERATE"
},
"details": "The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment\u0027s edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user\u0027s appointment. Because the Easy Appointments WordPress plugin through 3.12.26 then treats that metadata as the appointment\u0027s contact data, a subsequent administrator status change with customer notifications enabled delivers the victim\u0027s appointment notification to the attacker-controlled email address.",
"id": "GHSA-hqv9-x7qp-69hr",
"modified": "2026-07-29T15:31:10Z",
"published": "2026-07-29T09:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14224"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/c39226d5-1b6f-4f08-903c-7ecc67d17eb0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.