CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5253 vulnerabilities reference this CWE, most recent first.
GHSA-RRV7-3MQF-HXFR
Vulnerability from github – Published: 2026-05-19 12:31 – Updated: 2026-06-04 15:33A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-37978"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-04T15:26:30Z",
"nvd_published_at": "2026-05-19T12:16:17Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Keycloak. A low-privilege administrator with the \u0027view-clients\u0027 role can exploit this by invoking the \u0027evaluate-scopes\u0027 Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API.",
"id": "GHSA-rrv7-3mqf-hxfr",
"modified": "2026-06-04T15:33:01Z",
"published": "2026-05-19T12:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37978"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/492d1f04cdad425dadb9d5e1faa94dd17a875573"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/ba9a18744dcec2ef46f284d25c1c0aa1c962a500"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19596"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19597"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-37978"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455327"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak: Information Disclosure via evaluate-scopes Admin API"
}
GHSA-RV7J-GQ5M-787C
Vulnerability from github – Published: 2026-08-08 09:30 – Updated: 2026-08-11 21:32The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
{
"affected": [],
"aliases": [
"CVE-2026-16953"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-08T07:17:11Z",
"severity": "MODERATE"
},
"details": "The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest\u0027s uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim\u0027s session identifier and file reference can delete that victim\u0027s uploaded files.",
"id": "GHSA-rv7j-gq5m-787c",
"modified": "2026-08-11T21:32:28Z",
"published": "2026-08-08T09:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16953"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/8f5460a7-9764-4ce1-9cb4-8202b192765d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-RVC3-JCFP-627R
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-16 21:31n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve sensitive project and workflow information from projects they have no membership in.
{
"affected": [],
"aliases": [
"CVE-2026-85173"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T13:06:24Z",
"severity": "MODERATE"
},
"details": "n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve sensitive project and workflow information from projects they have no membership in.",
"id": "GHSA-rvc3-jcfp-627r",
"modified": "2026-09-16T21:31:37Z",
"published": "2026-09-03T15:32:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-jmmj-93rg-6j39"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85173"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-2.36.2-missing-authorization-via-insights-api"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RVC4-J32G-7VV5
Vulnerability from github – Published: 2026-09-23 15:30 – Updated: 2026-09-23 15:30ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.
{
"affected": [],
"aliases": [
"CVE-2026-86678"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-23T14:17:08Z",
"severity": "HIGH"
},
"details": "ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator\u2019s API key and use it to perform administrator-level actions.",
"id": "GHSA-rvc4-j32g-7vv5",
"modified": "2026-09-23T15:30:48Z",
"published": "2026-09-23T15:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86678"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86678.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RVG3-VFJ6-MF9F
Vulnerability from github – Published: 2026-08-11 12:30 – Updated: 2026-08-11 12:30An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the query to the authenticated organiser account. An attacker can modify event data and financial records across account boundaries.
{
"affected": [],
"aliases": [
"CVE-2026-72546"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T12:17:40Z",
"severity": "HIGH"
},
"details": "An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the query to the authenticated organiser account. An attacker can modify event data and financial records across account boundaries.",
"id": "GHSA-rvg3-vfj6-mf9f",
"modified": "2026-08-11T12:30:24Z",
"published": "2026-08-11T12:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72546"
},
{
"type": "WEB",
"url": "https://github.com/Attendize/Attendize"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RVHC-G4R6-X86W
Vulnerability from github – Published: 2026-08-17 21:31 – Updated: 2026-08-17 21:31phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).
{
"affected": [],
"aliases": [
"CVE-2026-75105"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-17T21:16:49Z",
"severity": "HIGH"
},
"details": "phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is \u0027subnets\u0027, the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).",
"id": "GHSA-rvhc-g4r6-x86w",
"modified": "2026-08-17T21:31:26Z",
"published": "2026-08-17T21:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75105"
},
{
"type": "WEB",
"url": "https://github.com/phpipam/phpipam/issues/4623"
},
{
"type": "WEB",
"url": "https://github.com/phpipam/phpipam/commit/2980be03652c0eb1db9fe2bcefaa210c854b9aea"
},
{
"type": "WEB",
"url": "https://github.com/phpipam/phpipam"
},
{
"type": "WEB",
"url": "https://github.com/phpipam/phpipam/releases/tag/v1.8.2"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/phpipam-temporary-subnet-share-information-disclosure-via-address-parameter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RVJ3-54W6-VRW6
Vulnerability from github – Published: 2024-08-08 12:30 – Updated: 2024-08-08 12:30A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.
{
"affected": [],
"aliases": [
"CVE-2024-3035"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-08T11:15:12Z",
"severity": "MODERATE"
},
"details": "A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.",
"id": "GHSA-rvj3-54w6-vrw6",
"modified": "2024-08-08T12:30:34Z",
"published": "2024-08-08T12:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3035"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2424715"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/452297"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RVM4-33RH-6FHP
Vulnerability from github – Published: 2026-07-22 00:32 – Updated: 2026-07-22 00:32Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Install / Upgrade Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iRecruitment accessible data as well as unauthorized read access to a subset of Oracle iRecruitment accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
{
"affected": [],
"aliases": [
"CVE-2026-61064"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T22:18:37Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Install / Upgrade Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iRecruitment accessible data as well as unauthorized read access to a subset of Oracle iRecruitment accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).",
"id": "GHSA-rvm4-33rh-6fhp",
"modified": "2026-07-22T00:32:13Z",
"published": "2026-07-22T00:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61064"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RVMR-CRPH-7VJ2
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the content of quote requests.
{
"affected": [],
"aliases": [
"CVE-2024-13558"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T12:15:13Z",
"severity": "HIGH"
},
"details": "The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the content of quote requests.",
"id": "GHSA-rvmr-crph-7vj2",
"modified": "2025-03-20T12:32:53Z",
"published": "2025-03-20T12:32:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13558"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3256816"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/woo-rfq-for-woocommerce/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5991c86b-6785-41a6-a5df-c65e8a28201c?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RVMV-5VH5-F3W7
Vulnerability from github – Published: 2026-10-15 09:30 – Updated: 2026-10-15 09:30The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. This makes it possible for authenticated attackers with Contributor-level access and above to read the title and content of any post, including private and pending posts belonging to other users.
{
"affected": [],
"aliases": [
"CVE-2026-108092"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-15T08:16:36Z",
"severity": "MODERATE"
},
"details": "The Blog2Social \u2013 Social Media Auto Post \u0026 Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. This makes it possible for authenticated attackers with Contributor-level access and above to read the title and content of any post, including private and pending posts belonging to other users.",
"id": "GHSA-rvmv-5vh5-f3w7",
"modified": "2026-10-15T09:30:34Z",
"published": "2026-10-15T09:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108092"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.4/includes/Ajax/Get.php#L253"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.4/includes/Ajax/Get.php#L275"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/9.1.4/includes/Ajax/Get.php#L622"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b394ee3e-fc1c-40b5-b3c5-a9b5e44a7a14?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.