Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

5289 vulnerabilities reference this CWE, most recent first.

GHSA-P65H-4XV9-C744

Vulnerability from github – Published: 2026-10-06 09:31 – Updated: 2026-10-06 09:31
VLAI
Details

Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-39756"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T09:17:47Z",
    "severity": "MODERATE"
  },
  "details": "Unauthenticated Insecure Direct Object References (IDOR) in Wappointment \u003c= 2.7.7 versions.",
  "id": "GHSA-p65h-4xv9-c744",
  "modified": "2026-10-06T09:31:26Z",
  "published": "2026-10-06T09:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39756"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/wappointment/vulnerability/wordpress-wappointment-plugin-2-7-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P6PH-3JX2-3337

Vulnerability from github – Published: 2026-07-24 22:32 – Updated: 2026-07-24 22:32
VLAI
Summary
OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
Details

Summary

An authorization bypass and information disclosure vulnerability exists in the search API of Openlist. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned BasePath restrictions to discover and access metadata of files residing in unauthorized sibling directories.

Details

This vulnerability stems from two combined logic flaws when the bleve search engine is utilized:

  1. Insecure Path Prefix Validation: In the search handler (server/handles/search.go), the application attempts to restrict search results to the user's allowed namespace using a simple prefix check: strings.HasPrefix(node.Parent, user.BasePath). Because this function is not path-separator aware, a user with a BasePath restricted to /base will successfully pass the authorization check for a completely separate directory named /base2 (since "/base2" starts with "/base").

  2. Unfiltered Total Count Leakage: The bleve backend (internal/search/bleve/search.go) searches the index globally and ignores the req.Parent boundary. Even if the application later successfully filters out unauthorized items from the Content array (e.g., via CanAccess meta password checks), it still returns the raw Total count provided by the search backend. This allows an attacker to perform blind data-enumeration, confirming the existence of sensitive files outside their namespace by observing the Total count.

PoC

Prerequisites: 1. Log in as an administrator and set the Search Index Mode to bleve. Build the index. 2. Create two directories at the root level: /base and /base2. 3. Upload a sensitive file into the unauthorized directory: /base2/secret_financial_report.pdf. 4. Create a low-privileged test user and strictly set their Base path to /base.

Exploitation Steps: 1. Authenticate as the newly created low-privileged user. 2. Send the following HTTP request to the search API:

POST /api/fs/search HTTP/1.1
Host: <your-openlist-host>
Authorization: <test-user-token>
Content-Type: application/json

{
  "parent": "/",
  "keywords": "secret",
  "page": 1,
  "per_page": 20,
  "scope": 0
}
  1. Observe the response: Due to the prefix bypass (strings.HasPrefix("/base2", "/base") == true), the metadata for secret_financial_report.pdf will be leaked in the response Content.
    • Alternatively, even if access is further blocked by folder-level passwords, the Total field will return > 0, allowing the attacker to blindly confirm the existence of the keyword "secret" in unauthorized global directories.

image

Impact

This is an Information Disclosure and Horizontal/Vertical Privilege Escalation vulnerability. Any authenticated user can enumerate hidden infrastructure, verify the existence of sensitive files (e.g., passwords, internal documents), and extract file metadata across the entire storage namespace, completely defeating the BasePath isolation mechanism.

Remediation Recommendations

  1. Separator-Aware Path Containment: Replace strings.HasPrefix with a robust path containment check. For example: target == base || strings.HasPrefix(target, base + "/"), or use a dedicated utility like utils.IsSubPath().
  2. Backend-Level Filtering: Enforce the path boundary within the bleve query itself (e.g., using indexed parent path hashes) rather than relying solely on post-query API filtering.
  3. Accurate Total Calculation: Compute the Total count only after all authorization and path filters have been applied to the result set.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.2.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OpenListTeam/OpenList/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T22:32:17Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn authorization bypass and information disclosure vulnerability exists in the search API of `Openlist`. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned `BasePath` restrictions to discover and access metadata of files residing in unauthorized sibling directories.\n\n### Details\nThis vulnerability stems from two combined logic flaws when the `bleve` search engine is utilized:\n\n1. **Insecure Path Prefix Validation:** In the search handler (`server/handles/search.go`), the application attempts to restrict search results to the user\u0027s allowed namespace using a simple prefix check: `strings.HasPrefix(node.Parent, user.BasePath)`. Because this function is not path-separator aware, a user with a `BasePath` restricted to `/base` will successfully pass the authorization check for a completely separate directory named `/base2` (since \"/base2\" starts with \"/base\").\n\n2. **Unfiltered Total Count Leakage:** The `bleve` backend (`internal/search/bleve/search.go`) searches the index globally and ignores the `req.Parent` boundary. Even if the application later successfully filters out unauthorized items from the `Content` array (e.g., via `CanAccess` meta password checks), it still returns the raw `Total` count provided by the search backend. This allows an attacker to perform blind data-enumeration, confirming the existence of sensitive files outside their namespace by observing the `Total` count.\n\n### PoC\n**Prerequisites:**\n1. Log in as an administrator and set the Search Index Mode to `bleve`. Build the index.\n2. Create two directories at the root level: `/base` and `/base2`.\n3. Upload a sensitive file into the unauthorized directory: `/base2/secret_financial_report.pdf`.\n4. Create a low-privileged test user and strictly set their `Base path` to `/base`.\n\n**Exploitation Steps:**\n1. Authenticate as the newly created low-privileged user.\n2. Send the following HTTP request to the search API:\n```http\nPOST /api/fs/search HTTP/1.1\nHost: \u003cyour-openlist-host\u003e\nAuthorization: \u003ctest-user-token\u003e\nContent-Type: application/json\n\n{\n  \"parent\": \"/\",\n  \"keywords\": \"secret\",\n  \"page\": 1,\n  \"per_page\": 20,\n  \"scope\": 0\n}\n```\n3. Observe the response: Due to the prefix bypass (`strings.HasPrefix(\"/base2\", \"/base\") == true`), the metadata for `secret_financial_report.pdf` will be leaked in the response Content.\n    - Alternatively, even if access is further blocked by folder-level passwords, the Total field will return \u003e 0, allowing the attacker to blindly confirm the existence of the keyword \"secret\" in unauthorized global directories.\n \n\u003cimg width=\"2112\" height=\"1381\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9f8c5e18-8744-4363-8d3f-5e6cf691f061\" /\u003e\n\n### Impact\nThis is an Information Disclosure and Horizontal/Vertical Privilege Escalation vulnerability. Any authenticated user can enumerate hidden infrastructure, verify the existence of sensitive files (e.g., passwords, internal documents), and extract file metadata across the entire storage namespace, completely defeating the BasePath isolation mechanism.\n\n### Remediation Recommendations\n1. Separator-Aware Path Containment: Replace strings.HasPrefix with a robust path containment check. For example: target == base || strings.HasPrefix(target, base + \"/\"), or use a dedicated utility like utils.IsSubPath().\n2. Backend-Level Filtering: Enforce the path boundary within the bleve query itself (e.g., using indexed parent path hashes) rather than relying solely on post-query API filtering.\n3. Accurate Total Calculation: Compute the Total count only after all authorization and path filters have been applied to the result set.",
  "id": "GHSA-p6ph-3jx2-3337",
  "modified": "2026-07-24T22:32:17Z",
  "published": "2026-07-24T22:32:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenListTeam/OpenList"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search"
}

GHSA-P6PV-Q7RC-G4H9

Vulnerability from github – Published: 2026-02-05 21:13 – Updated: 2026-02-13 17:16
VLAI
Summary
Unauthenticated Spree Commerce users can view completed guest orders by Order ID
Details

Unauthenticated users can view completed guest orders by Order ID (GHSL-2026-029)

The OrdersController#show action permits viewing completed guest orders by order number alone, without requiring the associated order token.

Order lookup without enforcing token requirement in OrdersController#show:

@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first

Authorization bypass for guest orders in authorize_access:

def authorize_access
  return true if @order.user_id.nil?

  @order.user == try_spree_current_user
end

If the attacker is in possession of a leaked Order ID, they might look it up directly via this API. Alternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are securely generated, but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)

Proof of Concept

  1. As a guest create a complete order.
  2. Fetch the latest Order ID from the database (Table: spree_orders).
  3. In another clean browser access following URL: <SPREE-HOST>/orders/<ORDER-ID>. (Sample: http://localhost:3000/orders/R496592563)

=> Full guest order details are disclosed including names, addresses and limited payment info.

Impact

This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).

CWEs

  • CWE-639: Authorization Bypass Through User-Controlled Key

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Disclosure Policy

This report is subject to a 90-day disclosure deadline, as described in more detail in our coordinated disclosure policy.

Severity
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_storefront"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_storefront"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "5.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_storefront"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.0"
            },
            {
              "fixed": "5.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree_storefront"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3.0"
            },
            {
              "fixed": "5.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25757"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-05T21:13:24Z",
    "nvd_published_at": "2026-02-06T23:15:54Z",
    "severity": "HIGH"
  },
  "details": "### Unauthenticated users can view completed guest orders by Order ID (`GHSL-2026-029`)\n\nThe `OrdersController#show` action permits viewing completed guest orders by order number alone, without requiring the associated order token.\n\nOrder lookup without enforcing token requirement in [`OrdersController#show`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14):\n\n```ruby\n@order = complete_order_finder.new(number: params[:id], token: params[:token], store: current_store).execute.first\n```\n\nAuthorization bypass for guest orders in [`authorize_access`](https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8):\n```ruby\ndef authorize_access\n  return true if @order.user_id.nil?\n\n  @order.user == try_spree_current_user\nend\n```\n\nIf the attacker is in possession of a leaked Order ID, they might look it up directly via this API.\nAlternatively, brute forcing all or parts of the possible Order IDs might be feasible for an attacker. (The Order IDs themselves are [securely generated](https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45), but with relatively low entropy: by default an order ID has a length of 9 and a base of 10, that would require an attacker to perform 1 billion requests to gather all guest orders. (At an assumed constant rate of 100 requests per second it would take 115 days.)\n\n\n#### Proof of Concept\n\n1. As a guest create a complete order.\n2. Fetch the latest Order ID from the database (Table: `spree_orders`).\n3. In another clean browser access following URL: `\u003cSPREE-HOST\u003e/orders/\u003cORDER-ID\u003e`. (Sample: `http://localhost:3000/orders/R496592563`)\n\n=\u003e Full guest order details are disclosed including names, addresses and limited payment info.\n\n#### Impact\n\nThis issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers).\n\n#### CWEs\n\n- CWE-639: Authorization Bypass Through User-Controlled Key\n\n### Credit\n\nThis issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) and manually verified by GHSL team members [@p- (Peter St\u00f6ckli)](https://github.com/p-) and [@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).\n\n### Disclosure Policy\n\nThis report is subject to a 90-day disclosure deadline, as described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).",
  "id": "GHSA-p6pv-q7rc-g4h9",
  "modified": "2026-02-13T17:16:21Z",
  "published": "2026-02-05T21:13:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25757"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1be"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1ad"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_storefront/CVE-2026-25757.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spree/spree"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Unauthenticated Spree Commerce users can view completed guest orders by Order ID"
}

GHSA-P6WV-4RVR-M4FH

Vulnerability from github – Published: 2025-01-11 09:30 – Updated: 2026-04-08 18:33
VLAI
Details

The Unlimited Theme Addon For Elementor and WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.1 via the 'uta-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-12116"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-11T08:15:24Z",
    "severity": "MODERATE"
  },
  "details": "The Unlimited Theme Addon For Elementor and WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.1 via the \u0027uta-template\u0027 shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.",
  "id": "GHSA-p6wv-4rvr-m4fh",
  "modified": "2026-04-08T18:33:47Z",
  "published": "2025-01-11T09:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12116"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3220786%40unlimited-theme-addons\u0026new=3220786%40unlimited-theme-addons\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/unlimited-theme-addons"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9dbdb6cc-2a00-4d34-9c11-62f3d1b51c73?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P6XJ-35FM-QGMF

Vulnerability from github – Published: 2025-03-11 21:30 – Updated: 2026-04-01 18:33
VLAI
Details

Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BP Email Assign Templates: from n/a through 1.6.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-28874"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-11T21:15:44Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BP Email Assign Templates: from n/a through 1.6.",
  "id": "GHSA-p6xj-35fm-qgmf",
  "modified": "2026-04-01T18:33:56Z",
  "published": "2025-03-11T21:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28874"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/bp-email-assign-templates/vulnerability/wordpress-bp-email-assign-templates-by-shanebp-plugin-1-6-arbitrary-content-deletion-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P76G-9C4W-2889

Vulnerability from github – Published: 2026-08-27 15:31 – Updated: 2026-08-27 15:31
VLAI
Details

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-81658"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-27T13:18:42Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.",
  "id": "GHSA-p76g-9c4w-2889",
  "modified": "2026-08-27T15:31:35Z",
  "published": "2026-08-27T15:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81658"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-81658"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524899"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P76W-G4QC-7G8W

Vulnerability from github – Published: 2023-08-14 21:30 – Updated: 2024-04-04 06:55
VLAI
Details

An issue was discovered in Tigergraph Enterprise 3.7.0. There is unsecured write access to SSH authorized keys file. Any code running as the tigergraph user is able to add their SSH public key into the authorised keys file. This allows an attacker to obtain password-less SSH key access by using their own SSH key.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-28481"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-14T19:15:10Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Tigergraph Enterprise 3.7.0. There is unsecured write access to SSH authorized keys file. Any code running as the tigergraph user is able to add their SSH public key into the authorised keys file. This allows an attacker to obtain password-less SSH key access by using their own SSH key.",
  "id": "GHSA-p76w-g4qc-7g8w",
  "modified": "2024-04-04T06:55:16Z",
  "published": "2023-08-14T21:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28481"
    },
    {
      "type": "WEB",
      "url": "https://neo4j.com/security/cve-2023-28481"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P79F-679R-6P3W

Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23
VLAI
Details

An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.

Severity
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-9170"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-17T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control.",
  "id": "GHSA-p79f-679r-6p3w",
  "modified": "2022-05-13T01:23:02Z",
  "published": "2022-05-13T01:23:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9170"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/blog/categories/releases"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/51971"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P7HW-7325-Q64V

Vulnerability from github – Published: 2026-10-01 12:31 – Updated: 2026-10-01 12:31
VLAI
Details

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.

Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:C/RE:L/U:Amber
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-64948"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-01T10:17:16Z",
    "severity": "HIGH"
  },
  "details": "Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.",
  "id": "GHSA-p7hw-7325-q64v",
  "modified": "2026-10-01T12:31:13Z",
  "published": "2026-10-01T12:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64948"
    },
    {
      "type": "WEB",
      "url": "https://pandorafms.com/en/security/common-vulnerabilities-and-exposures"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-P82R-QV5M-QV2W

Vulnerability from github – Published: 2026-10-16 18:34 – Updated: 2026-10-16 18:34
VLAI
Details

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-111689"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-16T18:17:52Z",
    "severity": "MODERATE"
  },
  "details": "Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.",
  "id": "GHSA-p82r-qv5m-qv2w",
  "modified": "2026-10-16T18:34:51Z",
  "published": "2026-10-16T18:34:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111689"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/manage/UserController.java#L223-L233"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/base/serviceimpl/UserServiceImpl.java#L178-L181"
    },
    {
      "type": "WEB",
      "url": "https://hackmd.io/@hieuPenguinnn/xboot-data-scope-filter-bypass-cross-dept-user-disclosure"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/xboot-through-3.3.4-authorization-bypass-via-getbydepartmentid-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list