CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5282 vulnerabilities reference this CWE, most recent first.
GHSA-PQ6R-P5VH-4C89
Vulnerability from github – Published: 2026-10-12 18:31 – Updated: 2026-10-12 18:31Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can combine counts with an objectId constraint as a membership oracle to reveal confidential memberships such as private groups or block lists.
{
"affected": [],
"aliases": [
"CVE-2026-109303"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-12T17:17:24Z",
"severity": "MODERATE"
},
"details": "Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can combine counts with an objectId constraint as a membership oracle to reveal confidential memberships such as private groups or block lists.",
"id": "GHSA-pq6r-p5vh-4c89",
"modified": "2026-10-12T18:31:46Z",
"published": "2026-10-12T18:31:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-rmhf-xv62-rm99"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109303"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/parse-server-before-8.6.93-and-9.0.0-before-9.10.1-alpha.13-protectedfields-bypass-via-relation-count-query"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PQF3-28PM-5446
Vulnerability from github – Published: 2026-01-02 03:30 – Updated: 2026-01-02 03:30The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
{
"affected": [],
"aliases": [
"CVE-2025-14998"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-02T03:15:50Z",
"severity": "CRITICAL"
},
"details": "The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user\u0027s identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s passwords, including administrators, and leverage that to gain access to their account.",
"id": "GHSA-pqf3-28pm-5446",
"modified": "2026-01-02T03:30:22Z",
"published": "2026-01-02T03:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14998"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.24/inc/modules/login-screen/signup-password.php#L24"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3429115/branda-white-labeling#file1749"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae46be82-570f-4172-9c3f-746b894b84b9?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PQVW-XCM9-69PH
Vulnerability from github – Published: 2022-11-21 12:30 – Updated: 2022-11-23 18:30The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.
{
"affected": [],
"aliases": [
"CVE-2022-1579"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-21T11:15:00Z",
"severity": "HIGH"
},
"details": "The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.",
"id": "GHSA-pqvw-xcm9-69ph",
"modified": "2022-11-23T18:30:28Z",
"published": "2022-11-21T12:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1579"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/6f3d40fa-458b-44f0-9407-763e80b29668"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PQX7-WMPC-GGM9
Vulnerability from github – Published: 2026-03-25 21:30 – Updated: 2026-03-25 21:30IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable due to Insecure Direct Object Reference (IDOR).
{
"affected": [],
"aliases": [
"CVE-2025-14974"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T21:16:24Z",
"severity": "MODERATE"
},
"details": "IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable due to Insecure Direct Object Reference (IDOR).",
"id": "GHSA-pqx7-wmpc-ggm9",
"modified": "2026-03-25T21:30:36Z",
"published": "2026-03-25T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14974"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7266723"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PR4J-5X2H-5VR8
Vulnerability from github – Published: 2026-08-14 00:32 – Updated: 2026-08-14 00:32streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.
{
"affected": [],
"aliases": [
"CVE-2026-73039"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T22:17:25Z",
"severity": "MODERATE"
},
"details": "streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users\u0027 viewing status records. Attackers can enumerate all users\u0027 watch progress, delete arbitrary viewing history, and manipulate other users\u0027 Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.",
"id": "GHSA-pr4j-5x2h-5vr8",
"modified": "2026-08-14T00:32:03Z",
"published": "2026-08-14T00:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73039"
},
{
"type": "WEB",
"url": "https://github.com/streamaserver/streama/issues/1170"
},
{
"type": "WEB",
"url": "https://github.com/streamaserver/streama/commit/1fa79534ee09e25f2473cc4787b106996008a442"
},
{
"type": "WEB",
"url": "https://github.com/streamaserver/streama"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/streama-insecure-direct-object-reference-via-viewingstatuscontroller"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PR7W-97G9-F8RW
Vulnerability from github – Published: 2026-09-11 12:33 – Updated: 2026-09-11 12:33AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.
{
"affected": [],
"aliases": [
"CVE-2026-89252"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-11T12:16:55Z",
"severity": "HIGH"
},
"details": "AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users\u0027 links. A canStream user can overwrite another user\u0027s LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.",
"id": "GHSA-pr7w-97g9-f8rw",
"modified": "2026-09-11T12:33:26Z",
"published": "2026-09-11T12:33:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m2c6-f5ww-j26v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89252"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/avideo-missing-authorization-in-addlivelink-php-livelink-update"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PRCX-3PC2-2J8X
Vulnerability from github – Published: 2026-08-29 06:30 – Updated: 2026-08-30 03:31The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other customers.
Exploitation requires the attacker to know the target subscription's identifier, which is high-entropy and not enumerable through the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5.
{
"affected": [],
"aliases": [
"CVE-2026-80311"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-29T06:17:49Z",
"severity": "MODERATE"
},
"details": "The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other customers.\n\nExploitation requires the attacker to know the target subscription\u0027s identifier, which is high-entropy and not enumerable through the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5.",
"id": "GHSA-prcx-3pc2-2j8x",
"modified": "2026-08-30T03:31:21Z",
"published": "2026-08-29T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80311"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/e1b0e815-e803-4a14-ab2a-ed860e82c782"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PRHP-PCRP-6FCH
Vulnerability from github – Published: 2026-10-12 18:31 – Updated: 2026-10-12 18:31A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.
{
"affected": [],
"aliases": [
"CVE-2026-109195"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-12T16:17:04Z",
"severity": "LOW"
},
"details": "A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target\u0027s name and know the target policy\u0027s unique identifier.",
"id": "GHSA-prhp-pcrp-6fch",
"modified": "2026-10-12T18:31:34Z",
"published": "2026-10-12T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109195"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-109195"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2549646"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PV42-3QX9-M56G
Vulnerability from github – Published: 2026-06-23 15:32 – Updated: 2026-06-24 00:30OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms() method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong to the caller's realm, enabling cross-tenant permanent destruction of safety-critical and security alerts.
{
"affected": [],
"aliases": [
"CVE-2026-56784"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-23T13:16:46Z",
"severity": "HIGH"
},
"details": "OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms() method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong to the caller\u0027s realm, enabling cross-tenant permanent destruction of safety-critical and security alerts.",
"id": "GHSA-pv42-3qx9-m56g",
"modified": "2026-06-24T00:30:30Z",
"published": "2026-06-23T15:32:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56784"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openremote-cross-tenant-idor-in-bulk-alarm-deletion"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openremote-manager-cross-tenant-idor-in-bulk-alarm-deletion"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PV47-2357-X653
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-24 21:33An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter
{
"affected": [],
"aliases": [
"CVE-2026-51367"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T14:17:32Z",
"severity": "HIGH"
},
"details": "An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter",
"id": "GHSA-pv47-2357-x653",
"modified": "2026-08-24T21:33:34Z",
"published": "2026-08-19T15:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51367"
},
{
"type": "WEB",
"url": "https://blog.elmec.com/cve-2026-51367-insecure-direct-object-reference-idor-leading-to-unauthorized-data-access"
},
{
"type": "WEB",
"url": "https://www.bottinelliinformatica.it/it/vedo-suite"
},
{
"type": "WEB",
"url": "https://www.cybergon.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.