CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5300 vulnerabilities reference this CWE, most recent first.
GHSA-MF94-378Q-XVC3
Vulnerability from github – Published: 2024-02-06 03:32 – Updated: 2024-02-13 18:38An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the payload parameter.
{
"affected": [],
"aliases": [
"CVE-2023-47022"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-06T01:15:07Z",
"severity": "MODERATE"
},
"details": "An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the payload parameter.",
"id": "GHSA-mf94-378q-xvc3",
"modified": "2024-02-13T18:38:22Z",
"published": "2024-02-06T03:32:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47022"
},
{
"type": "WEB",
"url": "https://docs.google.com/document/d/15s7NftTX2dxfcFnMqkFIyeN48xq3LceesWOhP-9xL4Y/edit?usp=sharing"
},
{
"type": "WEB",
"url": "https://github.com/Patrick0x41/Security-Advisories/tree/main/CVE-2023-47022"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MF94-5MC9-GXWW
Vulnerability from github – Published: 2026-10-11 00:30 – Updated: 2026-10-11 00:30JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients.
{
"affected": [],
"aliases": [
"CVE-2026-108642"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-10T22:16:39Z",
"severity": "MODERATE"
},
"details": "JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users\u0027 message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients.",
"id": "GHSA-mf94-5mc9-gxww",
"modified": "2026-10-11T00:30:55Z",
"published": "2026-10-11T00:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108642"
},
{
"type": "WEB",
"url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c094_announcementsend_edit.py"
},
{
"type": "WEB",
"url": "https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysAnnouncementSendController.java#L116-L131"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-idor-via-put-sys-sysannouncementsend-edit"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MF9G-Q8Q5-VFM5
Vulnerability from github – Published: 2023-01-17 21:30 – Updated: 2023-01-25 18:30The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL. The impact is unauthorized modification of a victim's LISTSERV account.
{
"affected": [],
"aliases": [
"CVE-2022-40319"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-17T21:15:00Z",
"severity": "HIGH"
},
"details": "The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL. The impact is unauthorized modification of a victim\u0027s LISTSERV account.",
"id": "GHSA-mf9g-q8q5-vfm5",
"modified": "2023-01-25T18:30:50Z",
"published": "2023-01-17T21:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40319"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/2301-exploits/listserv17-idor.txt"
},
{
"type": "WEB",
"url": "https://peach.ease.lsoft.com/scripts/wa-PEACH.exe?A0=LSTSRV-L"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MFCP-5RPW-XXC5
Vulnerability from github – Published: 2026-06-25 15:32 – Updated: 2026-06-25 15:32Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.
{
"affected": [],
"aliases": [
"CVE-2026-56013"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T14:16:50Z",
"severity": "MODERATE"
},
"details": "Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce \u003c= 3.0.15 versions.",
"id": "GHSA-mfcp-5rpw-xxc5",
"modified": "2026-06-25T15:32:01Z",
"published": "2026-06-25T15:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56013"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/license-manager-for-woocommerce/vulnerability/wordpress-license-manager-for-woocommerce-plugin-3-0-15-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-MFMF-M5JW-CFQH
Vulnerability from github – Published: 2023-06-28 03:31 – Updated: 2024-04-04 05:13This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system
{
"affected": [],
"aliases": [
"CVE-2022-48505"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-28T02:15:49Z",
"severity": "MODERATE"
},
"details": "This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system",
"id": "GHSA-mfmf-m5jw-cfqh",
"modified": "2024-04-04T05:13:40Z",
"published": "2023-06-28T03:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48505"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213488"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MFMP-8MQG-Q4WM
Vulnerability from github – Published: 2022-12-28 15:30 – Updated: 2023-01-10 15:46usememos/memos 0.9.0 and prior is vulnerable to Improper Access Control.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.9.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/usememos/memos"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-4803"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-30T19:58:20Z",
"nvd_published_at": "2022-12-28T14:15:00Z",
"severity": "HIGH"
},
"details": "usememos/memos 0.9.0 and prior is vulnerable to Improper Access Control.",
"id": "GHSA-mfmp-8mqg-q4wm",
"modified": "2023-01-10T15:46:53Z",
"published": "2022-12-28T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4803"
},
{
"type": "WEB",
"url": "https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53"
},
{
"type": "PACKAGE",
"url": "https://github.com/usememos/memos"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/0fba72b9-db10-4d9f-a707-2acf2004a286"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "usememos/memos Improper Access Control vulnerability"
}
GHSA-MFP8-Q392-37MJ
Vulnerability from github – Published: 2025-04-16 00:31 – Updated: 2025-04-16 00:31An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
{
"affected": [],
"aliases": [
"CVE-2025-31654"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-15T22:15:27Z",
"severity": "MODERATE"
},
"details": "An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., \"rooms\").",
"id": "GHSA-mfp8-q392-37mj",
"modified": "2025-04-16T00:31:38Z",
"published": "2025-04-16T00:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31654"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MFX5-4QV9-69F3
Vulnerability from github – Published: 2026-08-28 09:31 – Updated: 2026-08-28 18:31The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's.
{
"affected": [],
"aliases": [
"CVE-2026-79995"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-28T08:16:42Z",
"severity": "MODERATE"
},
"details": "The User Registration \u0026 Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user\u0027s in-progress email change, including an administrator\u0027s.",
"id": "GHSA-mfx5-4qv9-69f3",
"modified": "2026-08-28T18:31:28Z",
"published": "2026-08-28T09:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79995"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/551423b4-5c0c-48cc-9ba0-1f5637eea446"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MFXR-44MV-44Q4
Vulnerability from github – Published: 2026-09-23 21:30 – Updated: 2026-09-24 09:31A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization, a user with no privileges can use a relational filter as a boolean count-oracle to recover, character by character and across organizations, the secret recipient values of other tenants' notifications — including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This flaw affects confidentiality.
{
"affected": [],
"aliases": [
"CVE-2026-84713"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-23T20:17:17Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the automation-controller notification\n subsystem. Although NotificationTemplate.notification_\n configuration is protected from API filtering, its recipient\n value is copied in clear text into the unprotected\n Notification.recipients field on every send. Because the\n credential-types endpoint is listable by any authenticated\n user and the API filter backend traverses object relations\n without per-hop authorization, a user with no privileges can\n use a relational filter as a boolean count-oracle to recover,\n character by character and across organizations, the secret\n recipient values of other tenants\u0027 notifications \u2014 including\n PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook\n bearer-token URLs. This flaw affects confidentiality.",
"id": "GHSA-mfxr-44mv-44q4",
"modified": "2026-09-24T09:31:50Z",
"published": "2026-09-23T21:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84713"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:71177"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-84713"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527197"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MG36-6HJ2-XJ8Q
Vulnerability from github – Published: 2023-12-31 18:30 – Updated: 2026-04-28 21:33Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2.
{
"affected": [],
"aliases": [
"CVE-2023-51503"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-31T18:15:51Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments \u2013 Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments \u2013 Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2.",
"id": "GHSA-mg36-6hj2-xj8q",
"modified": "2026-04-28T21:33:41Z",
"published": "2023-12-31T18:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51503"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/woocommerce-payments/wordpress-woopayments-plugin-6-6-2-unauthenticated-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.