CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5244 vulnerabilities reference this CWE, most recent first.
GHSA-V455-8JMH-CHM4
Vulnerability from github – Published: 2026-10-19 15:32 – Updated: 2026-10-19 15:32FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.
{
"affected": [],
"aliases": [
"CVE-2026-112294"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-19T14:17:08Z",
"severity": "MODERATE"
},
"details": "FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users\u0027 content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.",
"id": "GHSA-v455-8jmh-chm4",
"modified": "2026-10-19T15:32:42Z",
"published": "2026-10-19T15:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112294"
},
{
"type": "WEB",
"url": "https://github.com/sunkaifei/FlyCms/issues/19"
},
{
"type": "WEB",
"url": "https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/module/model/service/ActionService.java"
},
{
"type": "WEB",
"url": "https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/web/front/ActionController.java"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/flycms-through-commit-edfdf724-missing-authorization-via-action-counter-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V487-79CJ-W3X8
Vulnerability from github – Published: 2023-07-05 03:30 – Updated: 2024-04-04 05:23Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization.
{
"affected": [],
"aliases": [
"CVE-2022-42175"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-05T03:15:09Z",
"severity": "HIGH"
},
"details": "Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization.",
"id": "GHSA-v487-79cj-w3x8",
"modified": "2024-04-04T05:23:12Z",
"published": "2023-07-05T03:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42175"
},
{
"type": "WEB",
"url": "https://gist.github.com/mr404ntf/9c8728ee8f35d9744feec3828df1085d"
},
{
"type": "WEB",
"url": "http://soluslabs.com"
},
{
"type": "WEB",
"url": "http://solusvm.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V492-6XX2-P57G
Vulnerability from github – Published: 2026-01-14 09:31 – Updated: 2026-01-14 21:16Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "chainlit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-68492"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-14T21:16:04Z",
"nvd_published_at": "2026-01-14T07:16:14Z",
"severity": "LOW"
},
"details": "Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.",
"id": "GHSA-v492-6xx2-p57g",
"modified": "2026-01-14T21:16:04Z",
"published": "2026-01-14T09:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68492"
},
{
"type": "WEB",
"url": "https://github.com/Chainlit/chainlit/pull/2637"
},
{
"type": "WEB",
"url": "https://github.com/Chainlit/chainlit/commit/8f1153db439eca58ae5c50c8276ba6fdd311448e"
},
{
"type": "PACKAGE",
"url": "https://github.com/Chainlit/chainlit"
},
{
"type": "WEB",
"url": "https://github.com/Chainlit/chainlit/releases"
},
{
"type": "WEB",
"url": "https://github.com/Chainlit/chainlit/releases/tag/2.8.5"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN34964581"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Chainlit contains an authorization bypass vulnerability"
}
GHSA-V492-QVFP-R274
Vulnerability from github – Published: 2022-08-16 00:00 – Updated: 2022-08-17 00:00The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink
{
"affected": [],
"aliases": [
"CVE-2022-2535"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-15T11:21:00Z",
"severity": "MODERATE"
},
"details": "The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink",
"id": "GHSA-v492-qvfp-r274",
"modified": "2022-08-17T00:00:23Z",
"published": "2022-08-16T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2535"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/0e13c375-044c-4c2e-ab8e-48cb89d90d02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V4JW-RCPM-RF82
Vulnerability from github – Published: 2026-09-26 15:31 – Updated: 2026-09-26 15:31Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app's own image namespace (e.g. org/{owner_org}/{app_id}/...). Updating apps.icon_url fires the on_app_update trigger, whose worker reads record.icon_url and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory.
{
"affected": [],
"aliases": [
"CVE-2026-100618"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-26T14:16:42Z",
"severity": "HIGH"
},
"details": "Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app\u0027s own image namespace (e.g. org/{owner_org}/{app_id}/...). Updating apps.icon_url fires the on_app_update trigger, whose worker reads record.icon_url and calls cleanStoredImageMetadata(), which runs with service-role credentials (supabaseAdmin()) and downloads and re-uploads the referenced storage object with upsert: true. As a result, an authenticated holder of an app-limited write API key can cause the privileged worker to rewrite an out-of-scope private image object (for example an organization logo) that the key cannot read or write directly under Supabase Storage RLS. All versions are affected; no patched version was available at the time of the advisory.",
"id": "GHSA-v4jw-rcpm-rf82",
"modified": "2026-09-26T15:31:15Z",
"published": "2026-09-26T15:31:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Cap-go/capgo.app/security/advisories/GHSA-669c-gwrr-hc53"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100618"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/capgo-app-icon-update-privilege-escalation-via-service-role-worker"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V56R-GGMC-WWXC
Vulnerability from github – Published: 2026-10-21 06:31 – Updated: 2026-10-21 12:31The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
{
"affected": [],
"aliases": [
"CVE-2026-107789"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-21T06:16:47Z",
"severity": "MODERATE"
},
"details": "The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.",
"id": "GHSA-v56r-ggmc-wwxc",
"modified": "2026-10-21T12:31:04Z",
"published": "2026-10-21T06:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107789"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/bce3568a-2fbd-40b7-927d-9f52d30d95c9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V574-8M96-8MP9
Vulnerability from github – Published: 2024-08-15 21:31 – Updated: 2024-08-16 18:30Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature.
{
"affected": [],
"aliases": [
"CVE-2024-27730"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T19:15:18Z",
"severity": "CRITICAL"
},
"details": "Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature.",
"id": "GHSA-v574-8m96-8mp9",
"modified": "2024-08-16T18:30:57Z",
"published": "2024-08-15T21:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27730"
},
{
"type": "WEB",
"url": "https://github.com/friendica/friendica/pull/13927"
},
{
"type": "WEB",
"url": "https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V5HG-WG2P-R5PM
Vulnerability from github – Published: 2025-10-22 18:30 – Updated: 2025-11-25 18:32Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests.
{
"affected": [],
"aliases": [
"CVE-2025-11957"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-22T17:15:56Z",
"severity": "HIGH"
},
"details": "Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests.",
"id": "GHSA-v5hg-wg2p-r5pm",
"modified": "2025-11-25T18:32:21Z",
"published": "2025-10-22T18:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11957"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2025-0015"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V5M8-5455-QW2X
Vulnerability from github – Published: 2026-06-10 15:31 – Updated: 2026-08-14 15:37A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the /api/v1/sources/{id}/image-url endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/kubev2v/migration-planner"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53470"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-14T15:37:35Z",
"nvd_published_at": "2026-06-10T15:16:41Z",
"severity": "CRITICAL"
},
"details": "A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim\u0027s source.",
"id": "GHSA-v5m8-5455-qw2x",
"modified": "2026-08-14T15:37:35Z",
"published": "2026-06-10T15:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53470"
},
{
"type": "WEB",
"url": "https://github.com/kubev2v/migration-planner/pull/1218"
},
{
"type": "WEB",
"url": "https://github.com/kubev2v/migration-planner/commit/ec47a336a620f4a995f29c1c53e4e4bd70a26e00"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-53470"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487069"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubev2v/migration-planner"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users\u0027 OVA images and agent JWTs"
}
GHSA-V5QF-WV6G-QJJ7
Vulnerability from github – Published: 2025-05-26 15:30 – Updated: 2025-05-26 15:30Insecure Direct Object Reference (IDOR) vulnerability in Clickedu. This vulnerability could allow an attacker to retrieve information about student report cards.
{
"affected": [],
"aliases": [
"CVE-2025-40650"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-26T13:15:19Z",
"severity": "HIGH"
},
"details": "Insecure Direct Object Reference (IDOR) vulnerability in Clickedu. This vulnerability could allow an attacker to retrieve information about student report cards.",
"id": "GHSA-v5qf-wv6g-qjj7",
"modified": "2025-05-26T15:30:33Z",
"published": "2025-05-26T15:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40650"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-idor-clickedu"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.