CWE-639
Weakness AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system.
For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Relationships and members
Modes of introduction
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Retrieval of a user record occurs in the system based on some key value that is under user control. The key would typically identify a user-related record stored in the system and would be used to lookup that record for presentation to the user.
One manifestation of this weakness is when a system uses sequential or otherwise easily-guessable session IDs that would allow one user to easily switch to another user's session and read/modify their data.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Notes
Maintenance
As of CWE 4.20, the relationship between IDOR and BOLA needs to be investigated more closely, including research into how these terms are used in the industry. The CWE team suspects that IDOR can be a part of BOLA, but BOLA expands on the weakness inherent to IDOR in that it is not only about objects that are being directly referenced.
Content history
Suggested corrections to use of IDOR versus BOLA
updated Common_Consequences, Relationships, Type
updated Description
updated Relationships
updated Relationships
updated Common_Consequences
updated Relationships
updated Alternate_Terms, Applicable_Platforms, Description, Name, Potential_Mitigations, Relationships
updated Common_Consequences, Relationships
updated Relationships
updated Alternate_Terms, Common_Consequences
updated Relationships
updated Relationships
updated Description, Enabling_Factors_for_Exploitation, Modes_of_Introduction, Relationships
updated Relationships
updated Relationships
updated Relationships
updated Alternate_Terms
updated Relationships
updated Alternate_Terms
updated Relationships
updated Detection_Factors, Relationships
updated Mapping_Notes
updated Observed_Examples
updated Demonstrative_Examples
updated References, Relationships, Weakness_Ordinalities
updated Alternate_Terms, Maintenance_Notes, References
updated Description, Modes_of_Introduction, Time_of_Introduction
5668 vulnerabilities reference this CWE, most recent first.
GHSA-X7WC-2853-87FV
Vulnerability from github – Published: 2025-10-25 00:30 – Updated: 2025-10-25 00:30GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API's object endpoints allow an authenticated user to request arbitrary user IDs and receive sensitive account data for those users, including the stored password and the account's security question and answer. The exposed recovery data and encrypted password may be used to reset or take over the target account.
{
"affected": [],
"aliases": [
"CVE-2025-34293"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-24T22:15:40Z",
"severity": "HIGH"
},
"details": "GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API\u0027s object endpoints allow an authenticated user to request arbitrary user IDs and receive sensitive account data for those users, including the stored password and the account\u0027s security question and answer. The exposed recovery data and encrypted password may be used to reset or take over the target account.",
"id": "GHSA-x7wc-2853-87fv",
"modified": "2025-10-25T00:30:39Z",
"published": "2025-10-25T00:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34293"
},
{
"type": "WEB",
"url": "https://nne.navigacloud.com/GN4Help/gn4_introduction_to_gn4.htm"
},
{
"type": "WEB",
"url": "https://www.miles33.com/news/news/5955/naviga--miles-33--acquisition.html"
},
{
"type": "WEB",
"url": "https://www.miles33.com/section/14/gn4"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/gn4-publishing-system-idor-information-disclosure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X7X8-RFPP-V489
Vulnerability from github – Published: 2025-10-16 09:30 – Updated: 2025-10-16 09:30The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the 'truelysell_edit_staff' shortcode.
{
"affected": [],
"aliases": [
"CVE-2025-10742"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-16T07:15:32Z",
"severity": "CRITICAL"
},
"details": "The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the \u0027truelysell_edit_staff\u0027 shortcode.",
"id": "GHSA-x7x8-rfpp-v489",
"modified": "2025-10-16T09:30:24Z",
"published": "2025-10-16T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10742"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/truelysell-service-booking-wordpress-theme/43398124"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a636e865-9556-4afb-8726-4537a160f379?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X824-RGWX-3CX4
Vulnerability from github – Published: 2026-09-29 21:33 – Updated: 2026-09-29 21:33KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in packages/server/src/controllers/reservation.controller.ts returns the record retrieved by the client-supplied identifier without comparing reservation.customerId to the authenticated principal
{
"affected": [],
"aliases": [
"CVE-2026-79348"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-29T20:17:26Z",
"severity": "MODERATE"
},
"details": "KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in packages/server/src/controllers/reservation.controller.ts returns the record retrieved by the client-supplied identifier without comparing reservation.customerId to the authenticated principal",
"id": "GHSA-x824-rgwx-3cx4",
"modified": "2026-09-29T21:33:26Z",
"published": "2026-09-29T21:33:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mighty840/kitchenasty/security/advisories/GHSA-2w4m-hjg2-2v92"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79348"
},
{
"type": "WEB",
"url": "https://github.com/mighty840/kitchenasty/pull/43"
},
{
"type": "WEB",
"url": "https://github.com/mighty840/kitchenasty"
},
{
"type": "WEB",
"url": "https://github.com/mighty840/kitchenasty/blob/main/packages/server/src/controllers/reservation.controller.ts"
},
{
"type": "WEB",
"url": "https://github.com/mighty840/kitchenasty/blob/main/packages/server/src/routes/reservation.routes.ts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X83G-979R-F5FH
Vulnerability from github – Published: 2026-07-31 16:52 – Updated: 2026-07-31 16:52Impact
Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId
with no ownership or session check. Chained, they expose customer PII.
GET /{_locale}/thank-you (PageRedirectController::thankYouAction, route
sylius_mollie_shop_thank_you_page_redirect) loads the order with findOneBy(['id' => $orderId])
and returns a 302 whose Location header carries that order's tokenValue. Any orderId
thus yields that order's token. A non-existent id dereferences null and returns a 500. The
handler also writes the raw orderId into the session.
GET /{_locale}/get-code (QrCodeAction::fetchQrCodeFromOrder, route
sylius_mollie_shop_get_qr_code) runs the same lookup and returns the order's QR code and id
as JSON, ignoring the session cart; this is where the front-end got the integer id. A bad id
500s here too.
That tokenValue is the order's only access control. Passed to the Sylius core page
GET /{_locale}/register-after-checkout/{tokenValue} it returns a form pre-filled with the
customer's first name, last name and email. The full attack: enumerate orderId, read the
token from the redirect, read the PII, at roughly a 1-in-71 hit rate for guest orders.
register-after-checkout is Sylius core, not the plugin, and trusts the token by design, so
the leak is what must be fixed.
None of the plugin endpoints require a login, session or CSRF token.
Patches
Fixed in 2.2.8, 3.2.4 and 3.3.1.
Workarounds
If you cannot upgrade immediately, patch both endpoints at the project level by decorating
the plugin controllers. The decorators enforce ownership before delegating to the original
controller, so no plugin behaviour is lost. They keep the original orderId request contract,
so no front-end or asset changes are required. Works on both 2.2 and 3.x.
Step 1. Decorate the QR code controller
Create src/Controller/Mollie/SecureQrCodeAction.php in your Sylius project:
<?php
declare(strict_types=1);
namespace App\Controller\Mollie;
use Sylius\Component\Order\Context\CartContextInterface;
use Sylius\Component\Order\Context\CartNotFoundException;
use Sylius\MolliePlugin\Controller\Shop\QrCodeAction;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
final class SecureQrCodeAction
{
private const OWNED_ORDER_IDS_SESSION_KEY = 'sylius_mollie.owned_order_ids';
public function __construct(
private readonly QrCodeAction $inner,
private readonly CartContextInterface $cartContext,
) {
}
public function fetchQrCodeFromOrder(Request $request): JsonResponse
{
$orderId = $request->get('orderId');
try {
$cart = $this->cartContext->getCart();
} catch (CartNotFoundException) {
$cart = null;
}
if (null !== $orderId && (null === $cart || (string) $cart->getId() !== (string) $orderId)) {
return new JsonResponse([], Response::HTTP_FORBIDDEN);
}
if (null !== $cart && null !== $cart->getId() && $request->hasSession()) {
$session = $request->getSession();
$ownedIds = $session->get(self::OWNED_ORDER_IDS_SESSION_KEY, []);
$ownedIds[(string) $cart->getId()] = true;
$session->set(self::OWNED_ORDER_IDS_SESSION_KEY, $ownedIds);
}
return $this->inner->fetchQrCodeFromOrder($request);
}
public function createPayment(Request $request): Response
{
return $this->inner->createPayment($request);
}
public function removeQrCodeFromOrder(Request $request): JsonResponse
{
return $this->inner->removeQrCodeFromOrder($request);
}
}
Step 2. Decorate the thank-you controller
Create src/Controller/Mollie/SecurePageRedirectController.php:
<?php
declare(strict_types=1);
namespace App\Controller\Mollie;
use Sylius\MolliePlugin\Controller\Shop\PageRedirectController;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\Routing\RouterInterface;
final class SecurePageRedirectController
{
private const OWNED_ORDER_IDS_SESSION_KEY = 'sylius_mollie.owned_order_ids';
public function __construct(
private readonly PageRedirectController $inner,
private readonly RouterInterface $router,
) {
}
public function thankYouAction(Request $request, SessionInterface $session): RedirectResponse
{
$orderId = $request->get('orderId');
if (null !== $orderId) {
$ownedIds = $session->get(self::OWNED_ORDER_IDS_SESSION_KEY, []);
if (!isset($ownedIds[(string) $orderId])) {
return new RedirectResponse($this->router->generate('sylius_shop_cart_summary'));
}
}
return $this->inner->thankYouAction($request, $session);
}
}
Step 3. Register the decorators
Append to your project's config/services.yaml:
services:
App\Controller\Mollie\SecureQrCodeAction:
decorates: sylius_mollie.controller.shop.qr_code
public: true
arguments:
$inner: '@.inner'
$cartContext: '@sylius.context.cart'
App\Controller\Mollie\SecurePageRedirectController:
decorates: sylius_mollie.controller.shop.page_redirect
public: true
arguments:
$inner: '@.inner'
$router: '@router'
Both decorators keep
@.innerand only add an ownership check onorderIdbefore handing the request to the original action, socreatePayment,removeQrCodeFromOrderand the thank-you redirect all keep their original behaviour and the front-end contract is unchanged.
Step 4. Clear the cache
bin/console cache:clear
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "sylius/mollie-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "sylius/mollie-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "sylius/mollie-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-68501"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T16:52:59Z",
"nvd_published_at": "2026-07-30T21:18:13Z",
"severity": "MODERATE"
},
"details": "### Impact\nTwo unauthenticated Mollie shop endpoints look up orders by a sequential integer `orderId`\nwith no ownership or session check. Chained, they expose customer PII.\n\n`GET /{_locale}/thank-you` (`PageRedirectController::thankYouAction`, route\n`sylius_mollie_shop_thank_you_page_redirect`) loads the order with `findOneBy([\u0027id\u0027 =\u003e $orderId])`\nand returns a `302` whose `Location` header carries that order\u0027s `tokenValue`. Any `orderId`\nthus yields that order\u0027s token. A non-existent id dereferences null and returns a `500`. The\nhandler also writes the raw `orderId` into the session.\n\n`GET /{_locale}/get-code` (`QrCodeAction::fetchQrCodeFromOrder`, route\n`sylius_mollie_shop_get_qr_code`) runs the same lookup and returns the order\u0027s QR code and id\nas JSON, ignoring the session cart; this is where the front-end got the integer id. A bad id\n`500`s here too.\n\nThat `tokenValue` is the order\u0027s only access control. Passed to the Sylius core page\n`GET /{_locale}/register-after-checkout/{tokenValue}` it returns a form pre-filled with the\ncustomer\u0027s first name, last name and email. The full attack: enumerate `orderId`, read the\ntoken from the redirect, read the PII, at roughly a 1-in-71 hit rate for guest orders.\n`register-after-checkout` is Sylius core, not the plugin, and trusts the token by design, so\nthe leak is what must be fixed.\n\nNone of the plugin endpoints require a login, session or CSRF token.\n\n### Patches\nFixed in **2.2.8**, **3.2.4** and **3.3.1**. \n\n### Workarounds\nIf you cannot upgrade immediately, patch both endpoints at the project level by decorating\nthe plugin controllers. The decorators enforce ownership before delegating to the original\ncontroller, so no plugin behaviour is lost. They keep the original `orderId` request contract,\nso no front-end or asset changes are required. Works on both 2.2 and 3.x.\n\n#### Step 1. Decorate the QR code controller\nCreate `src/Controller/Mollie/SecureQrCodeAction.php` in your Sylius project:\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\Controller\\Mollie;\n\nuse Sylius\\Component\\Order\\Context\\CartContextInterface;\nuse Sylius\\Component\\Order\\Context\\CartNotFoundException;\nuse Sylius\\MolliePlugin\\Controller\\Shop\\QrCodeAction;\nuse Symfony\\Component\\HttpFoundation\\JsonResponse;\nuse Symfony\\Component\\HttpFoundation\\Request;\nuse Symfony\\Component\\HttpFoundation\\Response;\n\nfinal class SecureQrCodeAction\n{\n private const OWNED_ORDER_IDS_SESSION_KEY = \u0027sylius_mollie.owned_order_ids\u0027;\n\n public function __construct(\n private readonly QrCodeAction $inner,\n private readonly CartContextInterface $cartContext,\n ) {\n }\n\n public function fetchQrCodeFromOrder(Request $request): JsonResponse\n {\n $orderId = $request-\u003eget(\u0027orderId\u0027);\n\n try {\n $cart = $this-\u003ecartContext-\u003egetCart();\n } catch (CartNotFoundException) {\n $cart = null;\n }\n\n if (null !== $orderId \u0026\u0026 (null === $cart || (string) $cart-\u003egetId() !== (string) $orderId)) {\n return new JsonResponse([], Response::HTTP_FORBIDDEN);\n }\n\n if (null !== $cart \u0026\u0026 null !== $cart-\u003egetId() \u0026\u0026 $request-\u003ehasSession()) {\n $session = $request-\u003egetSession();\n $ownedIds = $session-\u003eget(self::OWNED_ORDER_IDS_SESSION_KEY, []);\n $ownedIds[(string) $cart-\u003egetId()] = true;\n $session-\u003eset(self::OWNED_ORDER_IDS_SESSION_KEY, $ownedIds);\n }\n\n return $this-\u003einner-\u003efetchQrCodeFromOrder($request);\n }\n\n public function createPayment(Request $request): Response\n {\n return $this-\u003einner-\u003ecreatePayment($request);\n }\n\n public function removeQrCodeFromOrder(Request $request): JsonResponse\n {\n return $this-\u003einner-\u003eremoveQrCodeFromOrder($request);\n }\n}\n```\n\n#### Step 2. Decorate the thank-you controller\nCreate `src/Controller/Mollie/SecurePageRedirectController.php`:\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\Controller\\Mollie;\n\nuse Sylius\\MolliePlugin\\Controller\\Shop\\PageRedirectController;\nuse Symfony\\Component\\HttpFoundation\\RedirectResponse;\nuse Symfony\\Component\\HttpFoundation\\Request;\nuse Symfony\\Component\\HttpFoundation\\Session\\SessionInterface;\nuse Symfony\\Component\\Routing\\RouterInterface;\n\nfinal class SecurePageRedirectController\n{\n private const OWNED_ORDER_IDS_SESSION_KEY = \u0027sylius_mollie.owned_order_ids\u0027;\n\n public function __construct(\n private readonly PageRedirectController $inner,\n private readonly RouterInterface $router,\n ) {\n }\n\n public function thankYouAction(Request $request, SessionInterface $session): RedirectResponse\n {\n $orderId = $request-\u003eget(\u0027orderId\u0027);\n\n if (null !== $orderId) {\n $ownedIds = $session-\u003eget(self::OWNED_ORDER_IDS_SESSION_KEY, []);\n\n if (!isset($ownedIds[(string) $orderId])) {\n return new RedirectResponse($this-\u003erouter-\u003egenerate(\u0027sylius_shop_cart_summary\u0027));\n }\n }\n\n return $this-\u003einner-\u003ethankYouAction($request, $session);\n }\n}\n```\n\n#### Step 3. Register the decorators\nAppend to your project\u0027s `config/services.yaml`:\n\n```yaml\nservices:\n App\\Controller\\Mollie\\SecureQrCodeAction:\n decorates: sylius_mollie.controller.shop.qr_code\n public: true\n arguments:\n $inner: \u0027@.inner\u0027\n $cartContext: \u0027@sylius.context.cart\u0027\n\n App\\Controller\\Mollie\\SecurePageRedirectController:\n decorates: sylius_mollie.controller.shop.page_redirect\n public: true\n arguments:\n $inner: \u0027@.inner\u0027\n $router: \u0027@router\u0027\n```\n\n\u003e Both decorators keep `@.inner` and only add an ownership check on `orderId` before handing\n\u003e the request to the original action, so `createPayment`, `removeQrCodeFromOrder` and the\n\u003e thank-you redirect all keep their original behaviour and the front-end contract is unchanged.\n\n#### Step 4. Clear the cache\n```bash\nbin/console cache:clear\n```",
"id": "GHSA-x83g-979r-f5fh",
"modified": "2026-07-31T16:52:59Z",
"published": "2026-07-31T16:52:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-x83g-979r-f5fh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68501"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/pull/351"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/pull/352"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/pull/354"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/commit/01316b3ad3cf82e3c5ad160115d0a2cf89174e49"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/commit/153c754486b1bc597b67a90ac07ef71cd7958267"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/commit/d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a"
},
{
"type": "PACKAGE",
"url": "https://github.com/Sylius/MolliePlugin"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII"
}
GHSA-X847-VXVJ-G6RJ
Vulnerability from github – Published: 2022-06-03 00:01 – Updated: 2022-06-14 00:00An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.
{
"affected": [],
"aliases": [
"CVE-2022-1949"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-02T14:15:00Z",
"severity": "HIGH"
},
"details": "An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.",
"id": "GHSA-x847-vxvj-g6rj",
"modified": "2022-06-14T00:00:37Z",
"published": "2022-06-03T00:01:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1949"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2091781"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X869-HCCF-FV7R
Vulnerability from github – Published: 2026-10-06 15:32 – Updated: 2026-10-06 15:32An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
django.forms.models.BaseModelFormSet.save_existing_objects() used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model's primary key is a field accepted by the form, such as a OneToOneField or parent link used as the primary key of an inline formset's model, or a natural or UUID primary key included in the form's fields. This allows an authenticated user permitted to submit such a formset to delete rows outside the limiting queryset, without any permission on the targeted object, via forged management-form data marking an out-of-queryset object for deletion. Models using the default AutoField primary key are not affected.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Seonggwon Yoon for reporting this issue.
{
"affected": [],
"aliases": [
"CVE-2026-87975"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-06T14:17:47Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\n`django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form\u0027s instance as evidence that the instance belonged to the formset\u0027s limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model\u0027s primary key is a field accepted by the form, such as a `OneToOneField` or parent link used as the primary key of an inline formset\u0027s model, or a natural or UUID primary key included in the form\u0027s fields. This allows an authenticated user permitted to submit such a formset to delete rows outside the limiting queryset, without any permission on the targeted object, via forged management-form data marking an out-of-queryset object for deletion. Models using the default AutoField primary key are not affected.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seonggwon Yoon for reporting this issue.",
"id": "GHSA-x869-hccf-fv7r",
"modified": "2026-10-06T15:32:01Z",
"published": "2026-10-06T15:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87975"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/83cbd21be57483e6b3eb6e4688a561c841aff75e"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/b83ab92bc5474558b083a840ea4628b3261b2cfe"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/cce6c57ed30ea83725f9d6abb2fe5ee932bab107"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/ff27883ca055aa9ab23015b50674a5b10dfe5a41"
},
{
"type": "WEB",
"url": "https://docs.djangoproject.com/en/dev/releases/security"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/django-announce"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2026/oct/06/security-releases"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X8P6-MR22-V5C9
Vulnerability from github – Published: 2024-03-31 21:30 – Updated: 2026-04-28 21:34Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.
{
"affected": [],
"aliases": [
"CVE-2024-30543"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-31T19:15:47Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.",
"id": "GHSA-x8p6-mr22-v5c9",
"modified": "2026-04-28T21:34:29Z",
"published": "2024-03-31T21:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30543"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/whizzy/wordpress-whizzy-plugin-1-1-18-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X8QQ-M4QC-RPJ5
Vulnerability from github – Published: 2026-07-16 15:33 – Updated: 2026-07-16 15:33Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user's company.
{
"affected": [],
"aliases": [
"CVE-2026-59237"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-16T15:16:34Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user\u0027s company.",
"id": "GHSA-x8qq-m4qc-rpj5",
"modified": "2026-07-16T15:33:11Z",
"published": "2026-07-16T15:33:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59237"
},
{
"type": "WEB",
"url": "https://github.com/Roskus/prospero-flow-crm/commit/9a859c4de3d49674916773d346c60d89ad7febe0"
},
{
"type": "WEB",
"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3"
},
{
"type": "WEB",
"url": "https://secur0.com/en/cna/cve-list/cve-2026-59237-idor-in-prospero-flow-crm-order-api-allows-cross-tenant-read-and-modification-of-orders"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X8R8-2RH2-5H4P
Vulnerability from github – Published: 2026-11-05 06:34 – Updated: 2026-11-06 15:31The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
{
"affected": [],
"aliases": [
"CVE-2026-90967"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-11-05T06:17:10Z",
"severity": "MODERATE"
},
"details": "The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users\u0027 invoices, including the invoice owner\u0027s name, account email address and financial details.",
"id": "GHSA-x8r8-2rh2-5h4p",
"modified": "2026-11-06T15:31:25Z",
"published": "2026-11-05T06:34:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90967"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/745cf24b-2dbd-41ea-b26d-d1c6f0a25de9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X8VJ-X24H-RRFV
Vulnerability from github – Published: 2024-04-24 12:30 – Updated: 2025-02-04 18:30Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.
{
"affected": [],
"aliases": [
"CVE-2024-32808"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T11:15:48Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.",
"id": "GHSA-x8vj-x24h-rrfv",
"modified": "2025-02-04T18:30:45Z",
"published": "2024-04-24T12:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32808"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-9-insecure-direct-object-reference-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.