CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5312 vulnerabilities reference this CWE, most recent first.
GHSA-JXV5-G6WH-9V24
Vulnerability from github – Published: 2026-08-13 21:36 – Updated: 2026-08-13 21:36Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.
{
"affected": [],
"aliases": [
"CVE-2026-72666"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T20:17:27Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.",
"id": "GHSA-jxv5-g6wh-9v24",
"modified": "2026-08-13T21:36:09Z",
"published": "2026-08-13T21:36:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72666"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-97/389537"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JXV8-WV9V-5824
Vulnerability from github – Published: 2026-10-11 15:31 – Updated: 2026-10-11 15:31LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokeping_in or smokeping_out graphs with arbitrary device ids to view latency data and enumerate device names.
{
"affected": [],
"aliases": [
"CVE-2026-108715"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-11T13:17:14Z",
"severity": "MODERATE"
},
"details": "LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokeping_in or smokeping_out graphs with arbitrary device ids to view latency data and enumerate device names.",
"id": "GHSA-jxv8-wv9v-5824",
"modified": "2026-10-11T15:31:03Z",
"published": "2026-10-11T15:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108715"
},
{
"type": "WEB",
"url": "https://github.com/librenms/librenms"
},
{
"type": "WEB",
"url": "https://github.com/librenms/librenms/blob/26.9.1.1/LibreNMS/Util/Graph.php#L190-L198"
},
{
"type": "WEB",
"url": "https://github.com/librenms/librenms/blob/26.9.1.1/includes/html/graphs/smokeping/auth.inc.php#L3-L7"
},
{
"type": "WEB",
"url": "https://hackmd.io/@haind/librenms-smokeping-graph-src-device-auth-confusion"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/librenms-through-26.9.1.1-authorization-bypass-via-smokeping-graph-auth-inc-php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M227-GVMR-HX3V
Vulnerability from github – Published: 2026-09-24 06:31 – Updated: 2026-09-24 12:31The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.
{
"affected": [],
"aliases": [
"CVE-2026-93661"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-24T06:17:03Z",
"severity": "LOW"
},
"details": "The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event\u0027s tickets overwrite and reassign any ticket on the site to their own event.",
"id": "GHSA-m227-gvmr-hx3v",
"modified": "2026-09-24T12:31:22Z",
"published": "2026-09-24T06:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93661"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/8f1c665e-15e4-4b5d-853d-919723614611"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M246-64QF-M83C
Vulnerability from github – Published: 2023-12-21 21:30 – Updated: 2026-04-28 21:33Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from n/a through 3.8.3.
{
"affected": [],
"aliases": [
"CVE-2023-32799"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-21T19:15:08Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from n/a through 3.8.3.",
"id": "GHSA-m246-64qf-m83c",
"modified": "2026-04-28T21:33:33Z",
"published": "2023-12-21T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32799"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-3-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M2V2-8227-59F5
Vulnerability from github – Published: 2021-11-23 17:54 – Updated: 2021-11-24 19:00In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "concrete5/core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.5.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-22967"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-22T19:40:20Z",
"nvd_published_at": "2021-11-19T19:15:00Z",
"severity": "MODERATE"
},
"details": "In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in \"add / edit message\u201d.",
"id": "GHSA-m2v2-8227-59f5",
"modified": "2021-11-24T19:00:59Z",
"published": "2021-11-23T17:54:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22967"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/869612"
},
{
"type": "WEB",
"url": "https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Exposure of sensitive information in concrete5/core"
}
GHSA-M355-GFJX-99W5
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-05-24 19:18Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.
{
"affected": [],
"aliases": [
"CVE-2021-41306"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-26T05:15:00Z",
"severity": "HIGH"
},
"details": "Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.",
"id": "GHSA-m355-gfjx-99w5",
"modified": "2022-05-24T19:18:52Z",
"published": "2022-05-24T19:18:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41306"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/JRASERVER-72915"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M368-X5FJ-4332
Vulnerability from github – Published: 2026-10-16 18:34 – Updated: 2026-10-16 18:34B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft content via the k parameter, and use push2rhy to push others' articles to the Rhythm community.
{
"affected": [],
"aliases": [
"CVE-2026-111610"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T18:17:40Z",
"severity": "MODERATE"
},
"details": "B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors\u0027 articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors\u0027 drafts, probe draft content via the k parameter, and use push2rhy to push others\u0027 articles to the Rhythm community.",
"id": "GHSA-m368-x5fj-4332",
"modified": "2026-10-16T18:34:42Z",
"published": "2026-10-16T18:34:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111610"
},
{
"type": "WEB",
"url": "https://github.com/88250/solo"
},
{
"type": "WEB",
"url": "https://github.com/88250/solo/blob/v4.4.0/src/main/java/org/b3log/solo/processor/console/ArticleConsole.java#L87-L92"
},
{
"type": "WEB",
"url": "https://github.com/88250/solo/blob/v4.4.0/src/main/java/org/b3log/solo/service/ArticleQueryService.java#L485-L519"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/solo-article-console-cross-author-authz"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/b3log-solo-through-4.4.0-missing-authorization-in-articleconsole"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M39C-XJ94-687F
Vulnerability from github – Published: 2026-09-22 09:31 – Updated: 2026-09-22 09:31The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts, which could allow them to take control of the account.
{
"affected": [],
"aliases": [
"CVE-2026-93556"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-22T09:17:05Z",
"severity": "CRITICAL"
},
"details": "The \u2018/password/guardarClau/recover\u2019 endpoint accepts the \u2018usuariId\u2019 parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts, which could allow them to take control of the account.",
"id": "GHSA-m39c-xj94-687f",
"modified": "2026-09-22T09:31:13Z",
"published": "2026-09-22T09:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93556"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/direct-references-unsafe-objects-idor-tankuam-places-kompini"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M39H-F7FW-54QW
Vulnerability from github – Published: 2026-08-11 18:30 – Updated: 2026-08-11 18:30CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:user_id] to a victim's ID, causing the controller to load and mutate the victim's account, including overwriting administrator passwords to achieve full site takeover.
{
"affected": [],
"aliases": [
"CVE-2026-56721"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T16:17:33Z",
"severity": "HIGH"
},
"details": "CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user\u0027s credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:user_id] to a victim\u0027s ID, causing the controller to load and mutate the victim\u0027s account, including overwriting administrator passwords to achieve full site takeover.",
"id": "GHSA-m39h-f7fw-54qw",
"modified": "2026-08-11T18:30:48Z",
"published": "2026-08-11T18:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56721"
},
{
"type": "WEB",
"url": "https://github.com/owen2345/camaleon-cms/pull/1185"
},
{
"type": "WEB",
"url": "https://github.com/owen2345/camaleon-cms/commit/26345034523a505cb01615509b7f0a665e89ae3e"
},
{
"type": "WEB",
"url": "https://github.com/owen2345/camaleon-cms"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/camaleoncms-privilege-escalation-via-parameter-confusion-in-userscontroller"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M3G2-FXC2-5839
Vulnerability from github – Published: 2022-10-17 19:00 – Updated: 2022-10-21 12:00The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.
{
"affected": [],
"aliases": [
"CVE-2022-3282"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-17T12:15:00Z",
"severity": "MODERATE"
},
"details": "The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.",
"id": "GHSA-m3g2-fxc2-5839",
"modified": "2022-10-21T12:00:22Z",
"published": "2022-10-17T19:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3282"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/035dffef-4b4b-4afb-9776-7f6c5e56452c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.