Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5282 vulnerabilities reference this CWE, most recent first.
GHSA-PM84-XFF5-WQJQ
Vulnerability from github – Published: 2026-09-11 00:31 – Updated: 2026-09-11 00:31
VLAI
Details
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference.
Severity
7.4 (High)
{
"affected": [],
"aliases": [
"CVE-2026-80434"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-10T22:17:01Z",
"severity": "HIGH"
},
"details": "IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference.",
"id": "GHSA-pm84-xff5-wqjq",
"modified": "2026-09-11T00:31:15Z",
"published": "2026-09-11T00:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80434"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7286562"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PM9M-4JVW-F3Q5
Vulnerability from github – Published: 2026-08-11 12:30 – Updated: 2026-08-11 12:30
VLAI
Details
An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownership against the requesting organiser account. An attacker can inject bulk attendee data into any event in the system regardless of account boundaries.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2026-72547"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T12:17:40Z",
"severity": "HIGH"
},
"details": "An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownership against the requesting organiser account. An attacker can inject bulk attendee data into any event in the system regardless of account boundaries.",
"id": "GHSA-pm9m-4jvw-f3q5",
"modified": "2026-08-11T12:30:24Z",
"published": "2026-08-11T12:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72547"
},
{
"type": "WEB",
"url": "https://github.com/Attendize/Attendize"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PMC7-HMMW-G96Q
Vulnerability from github – Published: 2024-03-13 21:31 – Updated: 2024-12-04 22:37
VLAI
Summary
Bagisto vulnerable to Insecure Direct Object Reference (IDOR)
Details
Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.0 allows an attacker to obtain sensitive information via the invoice ID parameter.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bagisto/bagisto"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-36238"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-15T21:03:01Z",
"nvd_published_at": "2024-03-13T21:15:53Z",
"severity": "MODERATE"
},
"details": "Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.0 allows an attacker to obtain sensitive information via the invoice ID parameter.",
"id": "GHSA-pmc7-hmmw-g96q",
"modified": "2024-12-04T22:37:43Z",
"published": "2024-03-13T21:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36238"
},
{
"type": "WEB",
"url": "https://github.com/bagisto/bagisto/pull/4697"
},
{
"type": "WEB",
"url": "https://github.com/bagisto/bagisto/commit/2a24098cb582e072c87177e0ad17be45f240ad17"
},
{
"type": "WEB",
"url": "https://github.com/Ek-Saini/security/blob/main/IDOR-Bagisto"
},
{
"type": "PACKAGE",
"url": "https://github.com/bagisto/bagisto"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Bagisto vulnerable to Insecure Direct Object Reference (IDOR)"
}
GHSA-PMH5-6PJ5-85X2
Vulnerability from github – Published: 2025-02-26 21:30 – Updated: 2025-03-05 00:30
VLAI
Details
SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService API model.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-50687"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-26T21:15:17Z",
"severity": "CRITICAL"
},
"details": "SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService API model.",
"id": "GHSA-pmh5-6pj5-85x2",
"modified": "2025-03-05T00:30:33Z",
"published": "2025-02-26T21:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50687"
},
{
"type": "WEB",
"url": "https://en.sungrowpower.com/security-notice-detail-2/6114"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PMJC-X5XH-P27V
Vulnerability from github – Published: 2025-11-12 06:30 – Updated: 2025-11-12 06:30
VLAI
Details
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.139 via the 'post_attachment_upload' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to attach arbitrary image files to arbitrary places.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-12833"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-12T05:15:41Z",
"severity": "MODERATE"
},
"details": "The GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.139 via the \u0027post_attachment_upload\u0027 function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to attach arbitrary image files to arbitrary places.",
"id": "GHSA-pmjc-x5xh-p27v",
"modified": "2025-11-12T06:30:24Z",
"published": "2025-11-12T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12833"
},
{
"type": "WEB",
"url": "https://github.com/AyeCode/geodirectory/commit/db655b04be32a160c0abf73217faf0a50585aa92"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3393024%40geodirectory\u0026new=3393024%40geodirectory\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/geodirectory"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/408f0c2a-ef3c-4592-8722-d56afce92e24?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PMJJ-H5JM-VXH4
Vulnerability from github – Published: 2025-12-19 15:31 – Updated: 2025-12-20 17:41
VLAI
Summary
pretix has Broken Access Control Allowing Cross-User File Access via UUID
Details
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pretix"
},
"ranges": [
{
"events": [
{
"introduced": "2025.10.0"
},
{
"fixed": "2025.10.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pretix"
},
"ranges": [
{
"events": [
{
"introduced": "2025.9.0"
},
{
"fixed": "2025.9.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pretix"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2025.8.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-14882"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-20T17:41:16Z",
"nvd_published_at": "2025-12-19T13:16:02Z",
"severity": "LOW"
},
"details": "An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.",
"id": "GHSA-pmjj-h5jm-vxh4",
"modified": "2025-12-20T17:41:16Z",
"published": "2025-12-19T15:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14882"
},
{
"type": "WEB",
"url": "https://github.com/pretix/pretix/commit/4b5651862c57c6e384822d1d23292342126c479a"
},
{
"type": "PACKAGE",
"url": "https://github.com/pretix/pretix"
},
{
"type": "WEB",
"url": "https://pretix.eu/about/en/blog/20251219-release-2025-10-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "pretix has Broken Access Control Allowing Cross-User File Access via UUID"
}
GHSA-PMQC-V2G6-QW5W
Vulnerability from github – Published: 2024-02-08 12:30 – Updated: 2026-05-20 12:30
VLAI
Details
Authorization Bypass Through User-Controlled Key vulnerability in Mia Technology Inc. MİA-MED allows Authentication Abuse.This issue affects MİA-MED: before 1.0.7.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-6515"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-08T10:15:11Z",
"severity": "HIGH"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Mia Technology Inc. M\u0130A-MED allows Authentication Abuse.This issue affects M\u0130A-MED: before 1.0.7.",
"id": "GHSA-pmqc-v2g6-qw5w",
"modified": "2026-05-20T12:30:35Z",
"published": "2024-02-08T12:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6515"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0087"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-24-0087"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PMV9-7F92-57XH
Vulnerability from github – Published: 2024-09-10 15:31 – Updated: 2024-09-25 21:30
VLAI
Details
An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and before 7.2.5 may allow a remote attacker with low privileges to read sensitive data via a crafted HTTP request.
Severity
5.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-44254"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-10T15:15:14Z",
"severity": "MODERATE"
},
"details": "An authorization bypass through user-controlled key\u00a0[CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and before 7.2.5 may allow a remote attacker with low privileges to read sensitive data via a crafted HTTP request.",
"id": "GHSA-pmv9-7f92-57xh",
"modified": "2024-09-25T21:30:33Z",
"published": "2024-09-10T15:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44254"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-23-204"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PMXJ-M85W-6G4G
Vulnerability from github – Published: 2026-10-14 21:33 – Updated: 2026-10-14 21:33
VLAI
Details
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-110771"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T19:17:13Z",
"severity": "MODERATE"
},
"details": "Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.",
"id": "GHSA-pmxj-m85w-6g4g",
"modified": "2026-10-14T21:33:43Z",
"published": "2026-10-14T21:33:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110771"
},
{
"type": "WEB",
"url": "https://github.com/shopizer-ecommerce/shopizer/issues/1112"
},
{
"type": "WEB",
"url": "https://github.com/shopizer-ecommerce/shopizer"
},
{
"type": "WEB",
"url": "https://github.com/shopizer-ecommerce/shopizer/blob/9a1602a664ab882b5420ff4339db45af44a48423/sm-shop/src/main/java/com/salesmanager/shop/populator/catalog/PersistableProductReviewPopulator.java#L66"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/shopizer-rest-product-review-idor"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/shopizer-through-3.2.5-authorization-bypass-via-product-review-customerid"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PP2X-5MGR-8C5H
Vulnerability from github – Published: 2026-10-16 18:34 – Updated: 2026-10-16 18:34
VLAI
Details
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-111614"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T18:17:40Z",
"severity": "HIGH"
},
"details": "DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users\u0027 datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.",
"id": "GHSA-pp2x-5mgr-8c5h",
"modified": "2026-10-16T18:34:42Z",
"published": "2026-10-16T18:34:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111614"
},
{
"type": "WEB",
"url": "https://github.com/devlive-community/MetaForge/blob/2025.1.1/core/datacap-server/src/main/java/io/edurt/datacap/server/controller/BaseController.java#L91-L95"
},
{
"type": "WEB",
"url": "https://github.com/devlive-community/MetaForge/blob/2025.1.1/core/datacap-service/src/main/java/io/edurt/datacap/service/service/BaseService.java#L38-L43"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/metaforge-datacap-source-getbyid-cross-user-idor"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/datacap-through-2025.1.1-idor-via-basecontroller-getinfoforpath-exposes-credentials"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.