CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5265 vulnerabilities reference this CWE, most recent first.
GHSA-QHJM-7MGH-6MHM
Vulnerability from github – Published: 2026-08-07 06:30 – Updated: 2026-08-07 18:31The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.
{
"affected": [],
"aliases": [
"CVE-2026-15214"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-07T06:16:55Z",
"severity": "MODERATE"
},
"details": "The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer\u0027s subscription information (the subscribed product, status, and dates) by supplying that subscription\u0027s ID.",
"id": "GHSA-qhjm-7mgh-6mhm",
"modified": "2026-08-07T18:31:43Z",
"published": "2026-08-07T06:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15214"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/d11cfec5-e1e6-4a01-84e2-4d42be1a72ac"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QHM6-5M7C-9H8G
Vulnerability from github – Published: 2026-10-13 21:37 – Updated: 2026-10-20 18:31Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.
{
"affected": [],
"aliases": [
"CVE-2026-16753"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T20:17:28Z",
"severity": "HIGH"
},
"details": "Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim library-query identifier.",
"id": "GHSA-qhm6-5m7c-9h8g",
"modified": "2026-10-20T18:31:36Z",
"published": "2026-10-13T21:37:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16753"
},
{
"type": "WEB",
"url": "https://github.com/lowcoder-org/lowcoder"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/382143"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QHQ3-Q3P4-4FXM
Vulnerability from github – Published: 2024-04-05 12:31 – Updated: 2026-05-20 12:30Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS allows Authentication Abuse.This issue affects Extreme XDS: before 3914.
{
"affected": [],
"aliases": [
"CVE-2023-6523"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-05T12:15:37Z",
"severity": "HIGH"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS allows Authentication Abuse.This issue affects Extreme XDS: before 3914.",
"id": "GHSA-qhq3-q3p4-4fxm",
"modified": "2026-05-20T12:30:35Z",
"published": "2024-04-05T12:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6523"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0276"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-24-0276"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QHQF-328W-9GGV
Vulnerability from github – Published: 2023-11-20 21:31 – Updated: 2023-11-30 15:30An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/-'
{
"affected": [],
"aliases": [
"CVE-2023-38884"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-20T19:15:08Z",
"severity": "HIGH"
},
"details": "An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student\u0027s files by visiting \u0027/assets/studentfiles/\u003cstudentId\u003e-\u003cfilename\u003e\u0027",
"id": "GHSA-qhqf-328w-9ggv",
"modified": "2023-11-30T15:30:22Z",
"published": "2023-11-20T21:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38884"
},
{
"type": "WEB",
"url": "https://github.com/OS4ED/openSIS-Classic"
},
{
"type": "WEB",
"url": "https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38884"
},
{
"type": "WEB",
"url": "https://www.os4ed.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJ65-C6CR-78RM
Vulnerability from github – Published: 2022-08-16 00:00 – Updated: 2022-08-17 00:00Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.1.
{
"affected": [],
"aliases": [
"CVE-2022-2824"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-15T16:15:00Z",
"severity": "MODERATE"
},
"details": "Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.1.",
"id": "GHSA-qj65-c6cr-78rm",
"modified": "2022-08-17T00:00:22Z",
"published": "2022-08-16T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2824"
},
{
"type": "WEB",
"url": "https://github.com/openemr/openemr/commit/c5d99452c173ef21a8e2241e2bbf4b66e2d7fe11"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/1ccb2d1c-6881-4813-a5bc-1603d29b7141"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJ7C-X9C2-2674
Vulnerability from github – Published: 2026-10-16 09:30 – Updated: 2026-10-16 09:30Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-15219"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T09:17:04Z",
"severity": "MODERATE"
},
"details": "Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.\n\nThis issue affects Costifier: through 2026-10-16.\u00a0\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-qj7c-x9c2-2674",
"modified": "2026-10-16T09:30:30Z",
"published": "2026-10-16T09:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15219"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1349"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJGJ-875G-MQ5Q
Vulnerability from github – Published: 2026-02-10 09:30 – Updated: 2026-02-10 09:30An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.
{
"affected": [],
"aliases": [
"CVE-2025-12063"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T07:16:12Z",
"severity": "MODERATE"
},
"details": "An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.",
"id": "GHSA-qjgj-875g-mq5q",
"modified": "2026-02-10T09:30:26Z",
"published": "2026-02-10T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12063"
},
{
"type": "WEB",
"url": "https://www.axis.com/dam/public/bc/f0/5a/cve-2025-12063pdf-en-US-519288.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJQ2-685Q-J8GV
Vulnerability from github – Published: 2026-07-07 06:31 – Updated: 2026-07-07 06:31MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.
This issue affects MicroRealEstate: through 1.0.0-alpha3.
{
"affected": [],
"aliases": [
"CVE-2026-57868"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-07T06:16:22Z",
"severity": "HIGH"
},
"details": "MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.\n\nThis issue affects MicroRealEstate: through 1.0.0-alpha3.",
"id": "GHSA-qjq2-685q-j8gv",
"modified": "2026-07-07T06:31:24Z",
"published": "2026-07-07T06:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57868"
},
{
"type": "WEB",
"url": "https://github.com/microrealestate/microrealestate"
},
{
"type": "WEB",
"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-57868"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QJQ8-C6GX-G7MG
Vulnerability from github – Published: 2026-05-07 09:31 – Updated: 2026-05-07 09:31Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0.
{
"affected": [],
"aliases": [
"CVE-2026-27329"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-07T09:16:27Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0.",
"id": "GHSA-qjq8-c6gx-g7mg",
"modified": "2026-05-07T09:31:27Z",
"published": "2026-05-07T09:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27329"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/yith-woocommerce-wishlist/vulnerability/wordpress-yith-woocommerce-wishlist-plugin-4-12-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QM62-48PG-2F99
Vulnerability from github – Published: 2026-09-23 06:31 – Updated: 2026-09-23 12:31The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
{
"affected": [],
"aliases": [
"CVE-2026-84150"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-23T06:17:03Z",
"severity": "MODERATE"
},
"details": "The Directorist: AI-Powered Business Directory, Listings \u0026 Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user\u0027s saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user\u0027s favorites.",
"id": "GHSA-qm62-48pg-2f99",
"modified": "2026-09-23T12:31:09Z",
"published": "2026-09-23T06:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84150"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/c8e6b49b-874f-41d6-bff4-58e9fe559463"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.