Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

5294 vulnerabilities reference this CWE, most recent first.

GHSA-MMP5-653M-6RJV

Vulnerability from github – Published: 2026-08-03 15:32 – Updated: 2026-08-03 15:32
VLAI
Details

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' private lists by supplying a list_uuid parameter, transferring ownership and demoting global lists to personal configurations.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-69094"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-03T14:16:30Z",
    "severity": "MODERATE"
  },
  "details": "Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users\u0027 private lists by supplying a list_uuid parameter, transferring ownership and demoting global lists to personal configurations.",
  "id": "GHSA-mmp5-653m-6rjv",
  "modified": "2026-08-03T15:32:49Z",
  "published": "2026-08-03T15:32:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-rw2j-8c57-x6h2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69094"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/admidio-before-idor-via-save-temporary-mylist-function-php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MP28-4JVQ-G6X7

Vulnerability from github – Published: 2026-01-31 00:30 – Updated: 2026-01-31 00:30
VLAI
Details

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key.

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-36365"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-30T22:15:54Z",
    "severity": "MODERATE"
  },
  "details": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key.",
  "id": "GHSA-mp28-4jvq-g6x7",
  "modified": "2026-01-31T00:30:28Z",
  "published": "2026-01-31T00:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36365"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7257665"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MP5V-46H8-GW29

Vulnerability from github – Published: 2026-08-25 15:32 – Updated: 2026-08-25 15:32
VLAI
Details

Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.

Severity
10.0 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-77998"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T13:19:30Z",
    "severity": "CRITICAL"
  },
  "details": "Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO \u003c 11.0.2, SAML SP Single Sign On \u2013 Login with ADFS \u003c 6.4,  SAML SP Single Sign On \u2013 SAML SSO login with Google Apps \u003c 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP\u0027s openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error \u2014 bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.",
  "id": "GHSA-mp5v-46h8-gw29",
  "modified": "2026-08-25T15:32:59Z",
  "published": "2026-08-25T15:32:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77998"
    },
    {
      "type": "WEB",
      "url": "https://www.miniorange.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MP8J-P2MC-4HGV

Vulnerability from github – Published: 2026-08-01 15:30 – Updated: 2026-08-01 15:30
VLAI
Details

@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-67329"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-01T13:17:03Z",
    "severity": "HIGH"
  },
  "details": "@better-auth/stripe versions \u003e= 1.4.11 and \u003c 1.6.21, and \u003e= 1.7.0-beta.0 and \u003c 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller\u0027s active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization\u0027s billing details including payment methods, invoices, and subscription state.",
  "id": "GHSA-mp8j-p2mc-4hgv",
  "modified": "2026-08-01T15:30:28Z",
  "published": "2026-08-01T15:30:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-h3rm-78g3-j7cp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67329"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/better-auth-stripe-before-authorization-bypass-via-organization-subscription"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MPGM-9GR3-FHR6

Vulnerability from github – Published: 2026-07-11 09:34 – Updated: 2026-07-11 09:34
VLAI
Details

The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-10041"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-11T07:16:44Z",
    "severity": "MODERATE"
  },
  "details": "The WCFM \u2013 Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors\u0027 products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.",
  "id": "GHSA-mpgm-9gr3-fhr6",
  "modified": "2026-07-11T09:34:17Z",
  "published": "2026-07-11T09:34:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10041"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-ajax.php#L746"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-ajax.php#L779"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-ajax.php#L810"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-enquiry.php#L395"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.26/core/class-wcfm-notification.php#L1132"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-ajax.php#L746"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-ajax.php#L779"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-ajax.php#L810"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-enquiry.php#L395"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.27/core/class-wcfm-notification.php#L1132"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3588570%40wc-frontend-manager\u0026new=3588570%40wc-frontend-manager"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f88a18-5439-4759-ae9f-168f5efc3264?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MPMW-F6H6-3G26

Vulnerability from github – Published: 2026-08-20 18:44 – Updated: 2026-08-20 18:44
VLAI
Summary
Winter: My Account preview exposes another backend user's profile by record ID
Details

Impact

Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each take a record id from the URL.

index() passes the authenticated user's own id to the behavior, but the inherited actions were left routable and formFindModelObject() was not scoped, so a caller-supplied id resolved against an unscoped Backend\Models\User query:

GET /backend/backend/myaccount/preview/{other_user_id}

preview disclosed the target user's first name, last name, login, email address and avatar; update was equally routable and additionally disclosed role, group membership, superuser flag and throttle state. Password controls render a mask, so no credential material was exposed. Backend user ids are sequential and trivially enumerated, and as these are GET actions no CSRF token is involved.

The behavior's AJAX handlers (create_onSave, update_onSave, update_onDelete) were also dispatchable on these routes, but cross-user writes were blocked by the Backend\Models\User authorization guards added in v1.2.13. The confirmed impact is unauthorized disclosure of backend user profile data.

To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access.

Patches

MyAccount no longer exposes the generic record actions it never used as routes, and its form lookup is now pinned to the authenticated user:

  • protected $guarded = ['create', 'update', 'preview']; removes the inherited actions from routing. The guard has to be at the routing layer, as handler dispatch ({action}_{handler}) runs before the page action.
  • formExtendQuery() constrains every lookup made by the behavior to the current user's key.

This security issue has been fixed as of v1.2.14 (commit cdbc8f5a23db27f72ccec658a8e5769e6d9f6dcb).

Workarounds

There is no supported workaround other than upgrading. If you cannot upgrade immediately, you may apply the fix manually in modules/backend/controllers/MyAccount.php:

  1. Add protected $guarded = ['create', 'update', 'preview']; to the controller.
  2. Add a formExtendQuery() method that scopes the lookup to the current user:
public function formExtendQuery(\Winter\Storm\Database\Builder $query): void
{
    $query->whereKey($this->user->getKey());
}

References

  • https://github.com/wintercms/winter/security/advisories/GHSA-j5jq-cr68-v2xx
  • https://github.com/wintercms/winter/commit/cdbc8f5a23db27f72ccec658a8e5769e6d9f6dcb

Credit to Awwader (@NRAwwad) for reporting the issue.

For more information

If you have any questions or comments about this advisory: - Email us at hello@wintercms.com

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "winter/wn-backend-module"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.13"
            },
            {
              "fixed": "1.2.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.13"
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:44:45Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\n`Backend\\Controllers\\MyAccount`, introduced in v1.2.13, declares an empty `$requiredPermissions` array so that any authenticated backend user can manage their own account. It implements the `FormController` behavior, which exposes three routable actions \u2014 `create`, `update` and `preview` \u2014 that each take a record id from the URL.\n\n`index()` passes the authenticated user\u0027s own id to the behavior, but the inherited actions were left routable and `formFindModelObject()` was not scoped, so a caller-supplied id resolved against an unscoped `Backend\\Models\\User` query:\n\n```\nGET /backend/backend/myaccount/preview/{other_user_id}\n```\n\n`preview` disclosed the target user\u0027s first name, last name, login, email address and avatar; `update` was equally routable and additionally disclosed role, group membership, superuser flag and throttle state. Password controls render a mask, so no credential material was exposed. Backend user ids are sequential and trivially enumerated, and as these are `GET` actions no CSRF token is involved.\n\nThe behavior\u0027s AJAX handlers (`create_onSave`, `update_onSave`, `update_onDelete`) were also dispatchable on these routes, but cross-user writes were blocked by the `Backend\\Models\\User` authorization guards added in v1.2.13. The confirmed impact is unauthorized disclosure of backend user profile data.\n\nTo actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access.\n\n### Patches\n\n`MyAccount` no longer exposes the generic record actions it never used as routes, and its form lookup is now pinned to the authenticated user:\n\n- `protected $guarded = [\u0027create\u0027, \u0027update\u0027, \u0027preview\u0027];` removes the inherited actions from routing. The guard has to be at the routing layer, as handler dispatch (`{action}_{handler}`) runs before the page action.\n- `formExtendQuery()` constrains every lookup made by the behavior to the current user\u0027s key.\n\nThis security issue has been fixed as of **v1.2.14** (commit [`cdbc8f5a23db27f72ccec658a8e5769e6d9f6dcb`](https://github.com/wintercms/winter/commit/cdbc8f5a23db27f72ccec658a8e5769e6d9f6dcb)).\n\n### Workarounds\n\nThere is no supported workaround other than upgrading. If you cannot upgrade immediately, you may apply the fix manually in `modules/backend/controllers/MyAccount.php`:\n\n1. Add `protected $guarded = [\u0027create\u0027, \u0027update\u0027, \u0027preview\u0027];` to the controller.\n2. Add a `formExtendQuery()` method that scopes the lookup to the current user:\n\n```php\npublic function formExtendQuery(\\Winter\\Storm\\Database\\Builder $query): void\n{\n    $query-\u003ewhereKey($this-\u003euser-\u003egetKey());\n}\n```\n\n### References\n\n- https://github.com/wintercms/winter/security/advisories/GHSA-j5jq-cr68-v2xx\n- https://github.com/wintercms/winter/commit/cdbc8f5a23db27f72ccec658a8e5769e6d9f6dcb\n\n\nCredit to Awwader ([@NRAwwad](https://github.com/NRAwwad)) for reporting the issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n- Email us at [hello@wintercms.com](mailto:hello@wintercms.com)",
  "id": "GHSA-mpmw-f6h6-3g26",
  "modified": "2026-08-20T18:44:45Z",
  "published": "2026-08-20T18:44:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wintercms/winter/security/advisories/GHSA-mpmw-f6h6-3g26"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wintercms/winter/commit/cdbc8f5a23db27f72ccec658a8e5769e6d9f6dcb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wintercms/winter"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wintercms/winter/releases/tag/v1.2.14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Winter: My Account preview exposes another backend user\u0027s profile by record ID"
}

GHSA-MQ58-P8PV-XX7F

Vulnerability from github – Published: 2024-07-17 18:31 – Updated: 2024-08-01 15:32
VLAI
Details

NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report (that belongs to an arbitrary user).

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-38447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-17T18:15:03Z",
    "severity": "HIGH"
  },
  "details": "NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report (that belongs to an arbitrary user).",
  "id": "GHSA-mq58-p8pv-xx7f",
  "modified": "2024-08-01T15:32:05Z",
  "published": "2024-07-17T18:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38447"
    },
    {
      "type": "WEB",
      "url": "https://www.linkedin.com/pulse/idors-ncia-anet-v341-visionspace-technologies-hepxe"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MQ9G-XVH8-GXG3

Vulnerability from github – Published: 2026-10-16 00:31 – Updated: 2026-10-16 00:31
VLAI
Details

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-111355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-15T22:19:33Z",
    "severity": "MODERATE"
  },
  "details": "zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.",
  "id": "GHSA-mq9g-xvh8-gxg3",
  "modified": "2026-10-16T00:31:58Z",
  "published": "2026-10-16T00:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111355"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/Org/OrgService.cs#L64-L68"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L118-L144"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L595-L636"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L887-L900"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zhontai/Admin.Core/blob/v10.1.0/src/modules/admin/ZhonTai.Admin/Services/User/UserService.cs#L977-L1000"
    },
    {
      "type": "WEB",
      "url": "https://hackmd.io/@hieuPenguinnn/zhontai-admin-core-by-id-missing-data-scope-cross-dept"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/zhontai-admin-core-through-10.1.0-authorization-bypass-via-user-and-organization-by-id-endpoints"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MQWC-JXPP-F3RJ

Vulnerability from github – Published: 2026-05-20 03:31 – Updated: 2026-05-20 03:31
VLAI
Details

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver_pos_rest_authentication() permission callback, which uses a loose PHP comparison (==) to compare the attacker-supplied 'OliverAuth' header value against the 'oliver_pos_authorization_token' option. On fresh installations where the admin has not yet completed the connection flow, this option is unset (get_option returns false). Due to PHP's type juggling, the loose comparison '0' == false evaluates to true, allowing an unauthenticated attacker to bypass authentication by sending 'OliverAuth: 0'. This grants full access to all POS API endpoints, enabling attackers to read user data (including administrator details), update user profiles (including email addresses), and delete non-admin users. An admin account email reset can lead to site takeover.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-6072"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-20T02:16:37Z",
    "severity": "MODERATE"
  },
  "details": "The Oliver POS \u2013 A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver_pos_rest_authentication() permission callback, which uses a loose PHP comparison (==) to compare the attacker-supplied \u0027OliverAuth\u0027 header value against the \u0027oliver_pos_authorization_token\u0027 option. On fresh installations where the admin has not yet completed the connection flow, this option is unset (get_option returns false). Due to PHP\u0027s type juggling, the loose comparison \u00270\u0027 == false evaluates to true, allowing an unauthenticated attacker to bypass authentication by sending \u0027OliverAuth: 0\u0027. This grants full access to all POS API endpoints, enabling attackers to read user data (including administrator details), update user profiles (including email addresses), and delete non-admin users. An admin account email reset can lead to site takeover.",
  "id": "GHSA-mqwc-jxpp-f3rj",
  "modified": "2026-05-20T03:31:34Z",
  "published": "2026-05-20T03:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6072"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L170"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L195"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L231"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge.php#L1677"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge.php#L1679"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L170"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L195"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L231"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge.php#L1677"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge.php#L1679"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6aa922-9c58-445c-b88a-3d1d1c95102c?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MR39-QWFQ-3RMH

Vulnerability from github – Published: 2026-07-17 12:31 – Updated: 2026-07-17 12:31
VLAI
Details

Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance.

Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/R:I
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-22104"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-17T10:16:36Z",
    "severity": "HIGH"
  },
  "details": "Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance.",
  "id": "GHSA-mr39-qwfq-3rmh",
  "modified": "2026-07-17T12:31:29Z",
  "published": "2026-07-17T12:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22104"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/CVE-2026-22104"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/DIVD-2026-00010"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hashtopolis/server/releases/tag/v0.14.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:I/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list