CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5312 vulnerabilities reference this CWE, most recent first.
GHSA-JGFQ-MGXG-4QWM
Vulnerability from github – Published: 2026-01-27 09:30 – Updated: 2026-07-20 12:32The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2026-21721"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-27T09:15:48Z",
"severity": "HIGH"
},
"details": "The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization\u2011internal privilege escalation.",
"id": "GHSA-jgfq-mgxg-4qwm",
"modified": "2026-07-20T12:32:07Z",
"published": "2026-01-27T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21721"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2914"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2920"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3078"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3529"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40138"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41064"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:5633"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8229"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-21721"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433242"
},
{
"type": "WEB",
"url": "https://grafana.com/security/security-advisories/CVE-2026-21721"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21721.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JGG6-7GQ8-598M
Vulnerability from github – Published: 2026-02-10 15:30 – Updated: 2026-06-05 15:32Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted Identifiers.This issue affects Dinibh Patrol Tracking System: through 10022026.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-7347"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T15:16:05Z",
"severity": "HIGH"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted Identifiers.This issue affects Dinibh Patrol Tracking System: through 10022026.\n\nNOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-jgg6-7gq8-598m",
"modified": "2026-06-05T15:32:07Z",
"published": "2026-02-10T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7347"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0051"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-26-0051"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JGXG-6F9P-7GM5
Vulnerability from github – Published: 2026-10-25 06:30 – Updated: 2026-10-26 12:32The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
{
"affected": [],
"aliases": [
"CVE-2026-114742"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-25T06:16:31Z",
"severity": "LOW"
},
"details": "The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.",
"id": "GHSA-jgxg-6f9p-7gm5",
"modified": "2026-10-26T12:32:29Z",
"published": "2026-10-25T06:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114742"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/201b0ca5-366d-446e-a92f-6962cd200bd7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JH23-V8PG-3GXQ
Vulnerability from github – Published: 2025-03-14 06:30 – Updated: 2025-03-14 06:30The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. This is due to the plugin not properly validating a user's identity prior to updating their password through the account_settings_save_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
{
"affected": [],
"aliases": [
"CVE-2024-11284"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-14T05:15:40Z",
"severity": "CRITICAL"
},
"details": "The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. This is due to the plugin not properly validating a user\u0027s identity prior to updating their password through the account_settings_save_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s passwords, including administrators, and leverage that to gain access to their account.",
"id": "GHSA-jh23-v8pg-3gxq",
"modified": "2025-03-14T06:30:42Z",
"published": "2025-03-14T06:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11284"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8afe386e-1e4f-4668-8309-6d47dedb008a?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JH46-59X3-G5QH
Vulnerability from github – Published: 2026-10-06 21:31 – Updated: 2026-10-06 21:31Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index's document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index.
{
"affected": [],
"aliases": [
"CVE-2026-103009"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-06T20:17:14Z",
"severity": "HIGH"
},
"details": "Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index\u0027s document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index.",
"id": "GHSA-jh46-59x3-g5qh",
"modified": "2026-10-06T21:31:57Z",
"published": "2026-10-06T21:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103009"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JHCW-2W66-F34V
Vulnerability from github – Published: 2026-07-30 18:31 – Updated: 2026-07-31 21:31A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record.
{
"affected": [],
"aliases": [
"CVE-2026-15658"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T16:16:56Z",
"severity": "HIGH"
},
"details": "A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that\nreturns the records of other users without checking that the caller owns the data associated with that record.",
"id": "GHSA-jhcw-2w66-f34v",
"modified": "2026-07-31T21:31:52Z",
"published": "2026-07-30T18:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15658"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/790363"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JHV7-7892-GG9H
Vulnerability from github – Published: 2026-10-13 18:30 – Updated: 2026-10-13 18:30Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.
{
"affected": [],
"aliases": [
"CVE-2026-110098"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T17:17:33Z",
"severity": "MODERATE"
},
"details": "Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees\u0027 requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues\u0027 leave and overtime requests and read leave history.",
"id": "GHSA-jhv7-7892-gg9h",
"modified": "2026-10-13T18:30:54Z",
"published": "2026-10-13T18:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110098"
},
{
"type": "WEB",
"url": "https://github.com/jorani/jorani/issues/426"
},
{
"type": "WEB",
"url": "https://github.com/jorani/jorani/commit/59c403224401824489ec662934f71c90d27f614c"
},
{
"type": "WEB",
"url": "https://github.com/jorani/jorani/blob/v1.0.2/application/controllers/Extra.php#L151-L168"
},
{
"type": "WEB",
"url": "https://github.com/jorani/jorani/blob/v1.0.2/application/controllers/Leaves.php#L276-L298"
},
{
"type": "WEB",
"url": "https://github.com/jorani/jorani/releases/tag/v1.0.4"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/jorani-before-1.0.4-insecure-direct-object-reference-in-leave-and-overtime-requests"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JHVG-6GG5-QPMP
Vulnerability from github – Published: 2026-10-12 18:31 – Updated: 2026-10-12 18:31SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.
{
"affected": [],
"aliases": [
"CVE-2026-109334"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-12T17:17:29Z",
"severity": "HIGH"
},
"details": "SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.",
"id": "GHSA-jhvg-6gg5-qpmp",
"modified": "2026-10-12T18:31:50Z",
"published": "2026-10-12T18:31:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-w5v9-jc5f-5rmc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109334"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-cross-tenant-access-via-surreal-ns-surreal-db-headers-and-rpc-use"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JHVX-775R-CM5M
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-03 15:32Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.
{
"affected": [],
"aliases": [
"CVE-2026-85211"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T15:17:40Z",
"severity": "HIGH"
},
"details": "Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants\u0027 cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.",
"id": "GHSA-jhvx-775r-cm5m",
"modified": "2026-09-03T15:32:26Z",
"published": "2026-09-03T15:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85211"
},
{
"type": "WEB",
"url": "https://github.com/HumanSignal/label-studio/issues/9924"
},
{
"type": "WEB",
"url": "https://github.com/HumanSignal/label-studio"
},
{
"type": "WEB",
"url": "https://github.com/HumanSignal/label-studio/blob/1.23.0/label_studio/io_storages/proxy_api.py"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/label-studio-through-1.23.0-cross-organization-storage-uri-resolution"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JHW3-VP8X-97C7
Vulnerability from github – Published: 2025-02-25 15:34 – Updated: 2026-04-01 18:33Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Amelia: from n/a through 1.2.16.
{
"affected": [],
"aliases": [
"CVE-2025-26965"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-25T15:15:29Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Amelia: from n/a through 1.2.16.",
"id": "GHSA-jhw3-vp8x-97c7",
"modified": "2026-04-01T18:33:50Z",
"published": "2025-02-25T15:34:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26965"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-1-2-16-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.