CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5238 vulnerabilities reference this CWE, most recent first.
GHSA-VJWR-9399-CMX7
Vulnerability from github – Published: 2026-09-04 15:36 – Updated: 2026-09-04 15:36Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.
{
"affected": [],
"aliases": [
"CVE-2026-85624"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T15:17:42Z",
"severity": "HIGH"
},
"details": "Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users\u0027 private notes including attachments and tags.",
"id": "GHSA-vjwr-9399-cmx7",
"modified": "2026-09-04T15:36:13Z",
"published": "2026-09-04T15:36:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85624"
},
{
"type": "WEB",
"url": "https://github.com/blinkospace/blinko/issues/1217"
},
{
"type": "WEB",
"url": "https://github.com/blinkospace/blinko"
},
{
"type": "WEB",
"url": "https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/note.ts"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/blinko-1.8.7-cross-user-private-note-disclosure-via-notereferencelist"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VJX6-FJG9-4JV5
Vulnerability from github – Published: 2026-10-14 09:31 – Updated: 2026-10-14 09:31Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student.
{
"affected": [],
"aliases": [
"CVE-2026-110465"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T07:17:02Z",
"severity": "MODERATE"
},
"details": "Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student.",
"id": "GHSA-vjx6-fjg9-4jv5",
"modified": "2026-10-14T09:31:32Z",
"published": "2026-10-14T09:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110465"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-11273-b9383-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-11272-91666-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VM2X-VWH2-372V
Vulnerability from github – Published: 2026-07-30 06:32 – Updated: 2026-07-30 18:31The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
{
"affected": [],
"aliases": [
"CVE-2026-15255"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T06:25:02Z",
"severity": "MODERATE"
},
"details": "The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users\u0027 form submission data, including personal information.",
"id": "GHSA-vm2x-vwh2-372v",
"modified": "2026-07-30T18:31:33Z",
"published": "2026-07-30T06:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15255"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/21fa84b9-afa6-49f7-abb1-c1edabda3cd8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VM4X-RQWP-C27M
Vulnerability from github – Published: 2026-10-15 21:36 – Updated: 2026-10-15 21:36temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server's /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified.
{
"affected": [],
"aliases": [
"CVE-2026-108126"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-15T19:17:19Z",
"severity": "MODERATE"
},
"details": "temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server\u0027s /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified.",
"id": "GHSA-vm4x-rqwp-c27m",
"modified": "2026-10-15T21:36:02Z",
"published": "2026-10-15T21:36:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108126"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal-proxy/pull/221"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal-proxy/pull/222"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal-proxy/commit/508991c298b9ac31915dd7349ffa88d79fad3475"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal-proxy/commit/6843a2c4626aa2c7f00fbf54e4e9fa98f6254f07"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/dek.go#L54-L67"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/kek.go#L172-L180"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/vault.go#L256"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal-proxy/discussions/146"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal-proxy/releases/tag/v0.9.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VM54-J482-HX4H
Vulnerability from github – Published: 2026-02-23 18:32 – Updated: 2026-02-23 18:32An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
{
"affected": [],
"aliases": [
"CVE-2026-2698"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-23T17:23:30Z",
"severity": "MODERATE"
},
"details": "An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.",
"id": "GHSA-vm54-j482-hx4h",
"modified": "2026-02-23T18:32:02Z",
"published": "2026-02-23T18:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2698"
},
{
"type": "WEB",
"url": "https://https://docs.tenable.com/release-notes/Content/security-center/2026.htm"
},
{
"type": "WEB",
"url": "https://https://www.tenable.com/security/tns-2026-07"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VM63-J8CX-VF5M
Vulnerability from github – Published: 2024-11-28 18:38 – Updated: 2024-11-28 18:38The Primary Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.2 via the [prim_elementor_template] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created with Elementor that they should not have access to.
{
"affected": [],
"aliases": [
"CVE-2024-10670"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-28T10:15:04Z",
"severity": "MODERATE"
},
"details": "The Primary Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.2 via the [prim_elementor_template] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created with Elementor that they should not have access to.",
"id": "GHSA-vm63-j8cx-vf5m",
"modified": "2024-11-28T18:38:36Z",
"published": "2024-11-28T18:38:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10670"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3197298%40primary-addon-for-elementor\u0026new=3197298%40primary-addon-for-elementor\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/636bd8ce-4737-4117-9581-42c7dcb3ad22?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VM96-QM8V-2CGX
Vulnerability from github – Published: 2022-08-09 00:00 – Updated: 2022-08-12 00:01The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation
{
"affected": [],
"aliases": [
"CVE-2022-2367"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-08T14:15:00Z",
"severity": "HIGH"
},
"details": "The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good \"link\" parameter validation",
"id": "GHSA-vm96-qm8v-2cgx",
"modified": "2022-08-12T00:01:19Z",
"published": "2022-08-09T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2367"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/46afb0c6-2d0c-4a20-a9de-48f35ca93f0f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VM99-JJC2-8HW5
Vulnerability from github – Published: 2024-09-09 12:31 – Updated: 2024-09-17 18:33This vulnerability exists in TechExcel Back Office Software versions prior to 1.0.0 due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to unauthorized access to sensitive information belonging to other users.
{
"affected": [],
"aliases": [
"CVE-2024-8601"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-09T10:15:03Z",
"severity": "HIGH"
},
"details": "This vulnerability exists in TechExcel Back Office Software versions prior to 1.0.0 due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to unauthorized access to sensitive information belonging to other users.",
"id": "GHSA-vm99-jjc2-8hw5",
"modified": "2024-09-17T18:33:24Z",
"published": "2024-09-09T12:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8601"
},
{
"type": "WEB",
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2024-0285"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VMG6-WPCQ-G357
Vulnerability from github – Published: 2026-06-11 09:31 – Updated: 2026-06-11 09:31Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects WP Logo Showcase Responsive Slider and Carousel: from n/a through 3.6.
{
"affected": [],
"aliases": [
"CVE-2023-40200"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-11T09:16:25Z",
"severity": "MODERATE"
},
"details": "Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects WP Logo Showcase Responsive Slider and Carousel: from n/a through 3.6.",
"id": "GHSA-vmg6-wpcq-g357",
"modified": "2026-06-11T09:31:56Z",
"published": "2026-06-11T09:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40200"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-logo-showcase-responsive-slider-slider/vulnerability/wordpress-wp-logo-showcase-responsive-slider-and-carousel-plugin-3-6-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VMP7-RM2P-637R
Vulnerability from github – Published: 2026-07-30 06:32 – Updated: 2026-07-30 21:31The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.
{
"affected": [],
"aliases": [
"CVE-2026-13345"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T06:24:59Z",
"severity": "MODERATE"
},
"details": "The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private products that are otherwise withheld from public view.",
"id": "GHSA-vmp7-rm2p-637r",
"modified": "2026-07-30T21:31:43Z",
"published": "2026-07-30T06:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13345"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/45937bce-12db-4770-9f15-606c62469f6d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.