CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5263 vulnerabilities reference this CWE, most recent first.
GHSA-QMFJ-76R4-VWG3
Vulnerability from github – Published: 2023-05-20 12:30 – Updated: 2024-04-04 04:15Authorization Bypass Through User-Controlled Key vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Authentication Abuse, Authentication Bypass.This issue affects Rental Module: before 23.05.15.
{
"affected": [],
"aliases": [
"CVE-2023-2713"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-20T10:15:09Z",
"severity": "CRITICAL"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in \"Rental Module\" developed by third-party for Ideasoft\u0027s E-commerce Platform allows Authentication Abuse, Authentication Bypass.This issue affects Rental Module: before 23.05.15.\n\n",
"id": "GHSA-qmfj-76r4-vwg3",
"modified": "2024-04-04T04:15:38Z",
"published": "2023-05-20T12:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2713"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-23-0276"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QMGP-3M36-HH24
Vulnerability from github – Published: 2022-10-01 00:00 – Updated: 2022-10-05 00:00Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.
{
"affected": [],
"aliases": [
"CVE-2021-36865"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-30T19:15:00Z",
"severity": "MODERATE"
},
"details": "Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin \u003c= 7.3.4 at WordPress allows attackers to change the content of the quiz.",
"id": "GHSA-qmgp-3m36-hh24",
"modified": "2022-10-05T00:00:38Z",
"published": "2022-10-01T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36865"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/quiz-master-next/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QMMH-WQWC-Q978
Vulnerability from github – Published: 2026-08-06 15:32 – Updated: 2026-08-06 15:32Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.
{
"affected": [],
"aliases": [
"CVE-2026-65523"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-06T15:17:15Z",
"severity": "HIGH"
},
"details": "Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation \u003c= 2.0.1 versions.",
"id": "GHSA-qmmh-wqwc-q978",
"modified": "2026-08-06T15:32:46Z",
"published": "2026-08-06T15:32:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65523"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/forms-signature-formidable-online-contract-automation/vulnerability/wordpress-formidable-forms-signature-online-contract-automation-plugin-2-0-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QMRF-JRPR-RJX6
Vulnerability from github – Published: 2026-08-10 21:32 – Updated: 2026-10-02 23:11The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-yandex 4.5.1 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow-providers-yandex"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-68871"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-02T23:11:39Z",
"nvd_published_at": "2026-08-10T19:17:30Z",
"severity": "MODERATE"
},
"details": "The Yandex Lockbox secrets backend in Apache Airflow\u0027s Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team\u0027s namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-yandex 4.5.1 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.",
"id": "GHSA-qmrf-jrpr-rjx6",
"modified": "2026-10-02T23:11:39Z",
"published": "2026-08-10T21:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68871"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/70877"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/0d877a1a7680d779d3e8d24cf1bd50b0af1fc8d7"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/releases/tag/providers-yandex/4.5.1"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-yandex/PYSEC-2026-3715.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/jlj9tv085txk4t0j029mvh43mz89o63c"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/10/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Airflow Yandex Lockbox backend allows cross-team secret disclosure"
}
GHSA-QMX7-75C2-8553
Vulnerability from github – Published: 2026-08-17 06:33 – Updated: 2026-08-17 18:31The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.
{
"affected": [],
"aliases": [
"CVE-2026-14832"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-17T06:17:31Z",
"severity": "MODERATE"
},
"details": "The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer\u0027s phone number to retrieve that customer\u0027s loyalty profile, including name, email, and account balance.",
"id": "GHSA-qmx7-75c2-8553",
"modified": "2026-08-17T18:31:15Z",
"published": "2026-08-17T06:33:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14832"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/3b651e19-37f5-468e-8d0b-a82bbe04eaf2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QP9J-9FFQ-4C7V
Vulnerability from github – Published: 2026-07-22 21:32 – Updated: 2026-07-22 21:32IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request.
{
"affected": [],
"aliases": [
"CVE-2026-3482"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-22T19:17:03Z",
"severity": "MODERATE"
},
"details": "IBM Sterling B2B Integrator and IBM Sterling File Gateway\u00a06.2.0.0 through 6.2.0.5_2,\u00a0 6.2.1.0 through\u00a06.2.1.1_2, and\u00a0 6.2.2.0 through 6.2.2.0_1 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request.",
"id": "GHSA-qp9j-9ffq-4c7v",
"modified": "2026-07-22T21:32:05Z",
"published": "2026-07-22T21:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3482"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7280657"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QPF8-2MC2-HVMH
Vulnerability from github – Published: 2026-04-29 09:30 – Updated: 2026-04-29 09:30This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.
{
"affected": [],
"aliases": [
"CVE-2026-42515"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-29T09:16:24Z",
"severity": "HIGH"
},
"details": "This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.",
"id": "GHSA-qpf8-2mc2-hvmh",
"modified": "2026-04-29T09:30:24Z",
"published": "2026-04-29T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42515"
},
{
"type": "WEB",
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2026-0207"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QPGW-J75C-J585
Vulnerability from github – Published: 2024-07-31 21:32 – Updated: 2024-08-15 15:30An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack.
{
"affected": [],
"aliases": [
"CVE-2024-41254"
],
"database_specific": {
"cwe_ids": [
"CWE-347",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T21:15:17Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack.",
"id": "GHSA-qpgw-j75c-j585",
"modified": "2024-08-15T15:30:52Z",
"published": "2024-07-31T21:32:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41254"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/d857f268a53aa62402655c8dcd95c68f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QPHR-3MVQ-V466
Vulnerability from github – Published: 2026-06-01 09:31 – Updated: 2026-07-09 21:03The Event Log detail endpoint GET /api/v2/eventLogs/{event_log_id} in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint GET /api/v2/eventLogs applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rely on per-Dag audit-log scoping. Users are advised to upgrade to apache-airflow 3.2.2 or later.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46764"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-09T21:03:42Z",
"nvd_published_at": "2026-06-01T09:16:20Z",
"severity": "MODERATE"
},
"details": "The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint `GET /api/v2/eventLogs` applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rely on per-Dag audit-log scoping. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.",
"id": "GHSA-qphr-3mvq-v466",
"modified": "2026-07-09T21:03:42Z",
"published": "2026-06-01T09:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46764"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/67112"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/31/14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Airflow has an Authorization Bypass Through User-Controlled Key"
}
GHSA-QQ7J-4R39-WHMX
Vulnerability from github – Published: 2022-11-29 06:30 – Updated: 2022-12-02 15:30An Insecure Direct Object Reference (IDOR) vulnerability in the password reset function of Telos Alliance Omnia MPX Node 1.0.0-1.4.[*] allows attackers to arbitrarily change user and Administrator account passwords.
{
"affected": [],
"aliases": [
"CVE-2022-43326"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-29T05:15:00Z",
"severity": "HIGH"
},
"details": "An Insecure Direct Object Reference (IDOR) vulnerability in the password reset function of Telos Alliance Omnia MPX Node 1.0.0-1.4.[*] allows attackers to arbitrarily change user and Administrator account passwords.",
"id": "GHSA-qq7j-4r39-whmx",
"modified": "2022-12-02T15:30:25Z",
"published": "2022-11-29T06:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43326"
},
{
"type": "WEB",
"url": "https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-43326"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.