CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3406 vulnerabilities reference this CWE, most recent first.
GHSA-4V4P-87M3-5423
Vulnerability from github – Published: 2022-07-09 00:00 – Updated: 2022-07-20 01:32Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).
The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the dev branch of the idno/known repository.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "idno/known"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-30852"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-20T01:32:06Z",
"nvd_published_at": "2022-07-08T12:15:00Z",
"severity": "MODERATE"
},
"details": "Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).\n\nThe researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.",
"id": "GHSA-4v4p-87m3-5423",
"modified": "2022-07-20T01:32:06Z",
"published": "2022-07-09T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30852"
},
{
"type": "WEB",
"url": "https://blog.jitendrapatro.me/multiple-vulnerabilities-in-idno-known-php-cms-software"
},
{
"type": "PACKAGE",
"url": "https://github.com/idno/known"
},
{
"type": "WEB",
"url": "https://withknown.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Known v1.3.1 contains Insecure Direct Object Reference"
}
GHSA-4V78-J8G9-RPV2
Vulnerability from github – Published: 2025-07-22 21:31 – Updated: 2025-07-22 21:31Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks.
{
"affected": [],
"aliases": [
"CVE-2025-51479"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-22T19:15:25Z",
"severity": "MODERATE"
},
"details": "Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks.",
"id": "GHSA-4v78-j8g9-rpv2",
"modified": "2025-07-22T21:31:15Z",
"published": "2025-07-22T21:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51479"
},
{
"type": "WEB",
"url": "https://github.com/onyx-dot-app/onyx/pull/4714"
},
{
"type": "WEB",
"url": "https://github.com/onyx-dot-app/onyx"
},
{
"type": "WEB",
"url": "https://www.gecko.security/blog/cve-2025-51479"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4VCF-Q4XF-F48M
Vulnerability from github – Published: 2025-11-25 21:42 – Updated: 2025-11-25 21:42Summary
Affected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using POST /passkey/delete-passkey.
Details
ctx.body.id is implicitly trusted and used in passkey deletion queries.
better-auth applications configured with useNumberId may use auto incrementing IDs which makes it trivial to delete all passkeys via enumeration.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@better-auth/passkey"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-25T21:42:53Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "# Summary\n\nAffected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using `POST /passkey/delete-passkey`.\n\n# Details\n\n`ctx.body.id` is implicitly trusted and used in passkey deletion queries.\n\nbetter-auth applications configured with `useNumberId` may use auto incrementing IDs which makes it trivial to delete all passkeys via enumeration.",
"id": "GHSA-4vcf-q4xf-f48m",
"modified": "2025-11-25T21:42:53Z",
"published": "2025-11-25T21:42:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m"
},
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/commit/06d68239e"
},
{
"type": "PACKAGE",
"url": "https://github.com/better-auth/better-auth"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Better Auth Passkey Plugin allows passkey deletion through IDOR"
}
GHSA-4VP3-JQP3-FQXC
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2023-03-03 15:30In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account.
{
"affected": [],
"aliases": [
"CVE-2019-14245"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-21T19:15:00Z",
"severity": "MODERATE"
},
"details": "In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account.",
"id": "GHSA-4vp3-jqp3-fqxc",
"modified": "2023-03-03T15:30:24Z",
"published": "2022-05-24T16:54:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14245"
},
{
"type": "WEB",
"url": "https://centos-webpanel.com/changelog-cwp7"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154155/CentOS-Control-Web-Panel-CWP-0.9.8.851-Arbitrary-Database-Drop.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154155/CentOS-WebPanel.com-CentOS-Control-Web-Panel-CWP-0.9.8.851-Arbitrary-Database-Drop.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154155/CentOS-WebPanel.com-Control-Web-Panel-CWP-0.9.8.851-Arbitrary-Database-Drop.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4VQ2-QQ4M-VP5X
Vulnerability from github – Published: 2026-02-03 15:30 – Updated: 2026-02-03 18:30Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through <= 3.4.0.
{
"affected": [],
"aliases": [
"CVE-2026-24991"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-03T15:16:18Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through \u003c= 3.4.0.",
"id": "GHSA-4vq2-qq4m-vp5x",
"modified": "2026-02-03T18:30:43Z",
"published": "2026-02-03T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24991"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/extensions-for-cf7/vulnerability/wordpress-extensions-for-cf7-plugin-3-4-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4W3X-69M8-478C
Vulnerability from github – Published: 2026-07-24 15:33 – Updated: 2026-07-24 15:33A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.
{
"affected": [],
"aliases": [
"CVE-2026-17059"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-24T15:17:13Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.",
"id": "GHSA-4w3x-69m8-478c",
"modified": "2026-07-24T15:33:02Z",
"published": "2026-07-24T15:33:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17059"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-17059"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506746"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4W6R-5C2J-QF5F
Vulnerability from github – Published: 2026-06-05 16:03 – Updated: 2026-07-20 21:19Summary
Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base.
Details
A new sanitizeListArgsForPublicView helper now strips request keys that should
never be caller-controlled (e.g. getHiddenColumn, nested), parses where
clauses against a restricted alias map that only contains visible columns, and
recursively removes filter/sort entries whose fk_column_id is not in the visible
set. validateGroupByColumnNames and validateGroupColumnId reject groupBy
requests whose column_name (CSV-style) or groupColumnId is not in the visible
or group-by column set. relDataList now checks column.fk_model_id ===
currentModel.id before resolving the linked table, matching the pre-existing
check on publicMmList and publicHmList.
Impact
Anyone with a shared-view UUID could enumerate hidden-column values directly (via groupBy), confirm hidden-column values by observing row counts (via filter), or read records from unrelated tables in the same base (via the related-data list). No authentication was required.
Credit
This issue was reported by @0xBassia. It was independently reported by @b-hermes.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nocodb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.04.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47378"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-05T16:03:11Z",
"nvd_published_at": "2026-06-23T21:16:59Z",
"severity": "MODERATE"
},
"details": "### Summary\nPublic shared-view endpoints exposed values from columns that the view owner had\nhidden, via three independent paths: groupBy returned raw values for any column\nnamed in the request, filter and sort arrays operated on hidden columns enabling\nboolean-blind extraction, and the related-data list accepted arbitrary link-column\nIDs from other tables in the same base.\n\n### Details\nA new `sanitizeListArgsForPublicView` helper now strips request keys that should\nnever be caller-controlled (e.g. `getHiddenColumn`, `nested`), parses `where`\nclauses against a restricted alias map that only contains visible columns, and\nrecursively removes filter/sort entries whose `fk_column_id` is not in the visible\nset. `validateGroupByColumnNames` and `validateGroupColumnId` reject groupBy\nrequests whose `column_name` (CSV-style) or `groupColumnId` is not in the visible\nor group-by column set. `relDataList` now checks `column.fk_model_id ===\ncurrentModel.id` before resolving the linked table, matching the pre-existing\ncheck on `publicMmList` and `publicHmList`.\n\n### Impact\nAnyone with a shared-view UUID could enumerate hidden-column values directly (via\ngroupBy), confirm hidden-column values by observing row counts (via filter), or\nread records from unrelated tables in the same base (via the related-data list).\nNo authentication was required.\n\n### Credit\nThis issue was reported by [@0xBassia](https://github.com/0xBassia).\nIt was independently reported by [@b-hermes](https://github.com/b-hermes).",
"id": "GHSA-4w6r-5c2j-qf5f",
"modified": "2026-07-20T21:19:44Z",
"published": "2026-06-05T16:03:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-4w6r-5c2j-qf5f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47378"
},
{
"type": "PACKAGE",
"url": "https://github.com/nocodb/nocodb"
},
{
"type": "WEB",
"url": "https://github.com/nocodb/nocodb/releases/tag/2026.04.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "NocoDB: Hidden Column Exposure in Public Shared View Endpoints"
}
GHSA-4W94-X732-JCMM
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-03-26 15:30Authorization Bypass Through User-Controlled Key vulnerability in LatePoint LatePoint latepoint allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LatePoint: from n/a through <= 5.2.6.
{
"affected": [],
"aliases": [
"CVE-2026-32533"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T17:17:06Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in LatePoint LatePoint latepoint allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LatePoint: from n/a through \u003c= 5.2.6.",
"id": "GHSA-4w94-x732-jcmm",
"modified": "2026-03-26T15:30:34Z",
"published": "2026-03-25T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32533"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/latepoint/vulnerability/wordpress-latepoint-plugin-5-2-6-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4WH7-QF8P-938F
Vulnerability from github – Published: 2025-10-27 15:30 – Updated: 2025-10-27 15:30A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User Profile Handler. Performing manipulation results in authorization bypass. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-12288"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-27T15:15:37Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User Profile Handler. Performing manipulation results in authorization bypass. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-4wh7-qf8p-938f",
"modified": "2025-10-27T15:30:42Z",
"published": "2025-10-27T15:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12288"
},
{
"type": "WEB",
"url": "https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12288.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.329956"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.329956"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.674883"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4WJP-4MM4-3WRH
Vulnerability from github – Published: 2024-08-12 15:30 – Updated: 2025-01-13 21:30A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component.
{
"affected": [],
"aliases": [
"CVE-2024-7658"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-99"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-12T13:38:49Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component.",
"id": "GHSA-4wjp-4mm4-3wrh",
"modified": "2025-01-13T21:30:47Z",
"published": "2024-08-12T15:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7658"
},
{
"type": "WEB",
"url": "https://github.com/projectsend/projectsend/commit/eb5a04774927e5855b9d0e5870a2aae5a3dc5a08"
},
{
"type": "WEB",
"url": "https://github.com/projectsend/projectsend/releases/tag/r1720"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.274115"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.274115"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.385000"
},
{
"type": "WEB",
"url": "https://www.kiyell.com/private-files-from-projectsend-idor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.