CWE-639

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "parse-path"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0624"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-05T22:13:37Z",
    "nvd_published_at": "2022-06-28T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.",
  "id": "GHSA-3j8f-xvm3-ffx4",
  "modified": "2022-07-08T17:05:50Z",
  "published": "2022-06-29T00:00:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0624"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ionicabizau/parse-path/commit/f9ad8856a3c8ae18e1cf4caef5edbabbc42840e8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ionicabizau/parse-path"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/afffb2bd-fb06-4144-829e-ecbbcbc85388"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authorization Bypass in parse-path"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-13740"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-18T03:15:10Z",
    "severity": "MODERATE"
  },
  "details": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pm_messenger_show_messages function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read private conversations of other users.",
  "id": "GHSA-3jqh-85c5-qcrg",
  "modified": "2025-02-18T03:31:05Z",
  "published": "2025-02-18T03:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13740"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/public/class-profile-magic-public.php#L1299"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a1b1a4-df72-4666-b116-882af4cd5796?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-4817"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-99"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T15:45:08Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been found in Campcodes Online Laundry Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file manage_user.php of the component HTTP Request Parameter Handler. The manipulation of the argument id leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263938 is the identifier assigned to this vulnerability.",
  "id": "GHSA-3jvh-pgp8-6866",
  "modified": "2025-02-20T18:31:15Z",
  "published": "2024-05-14T18:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4817"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yylmm/CVE/blob/main/Online%20Laundry%20Management%20System/IDOR_manage_user.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.263938"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.263938"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.333055"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@clerk/clerk-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.88.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-63700"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-21T00:38:59Z",
    "nvd_published_at": "2025-11-20T19:16:21Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage.",
  "id": "GHSA-3mm3-wfpv-q85g",
  "modified": "2025-11-21T00:38:59Z",
  "published": "2025-11-20T21:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63700"
    },
    {
      "type": "WEB",
      "url": "https://clerk.com"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/clerk/javascript"
    },
    {
      "type": "WEB",
      "url": "https://github.com/itsnishat08/CVE-2025-63700"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-3091"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-24T09:15:25Z",
    "severity": "HIGH"
  },
  "details": "An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.",
  "id": "GHSA-3mpf-fhf9-62mx",
  "modified": "2025-06-26T21:31:05Z",
  "published": "2025-06-26T21:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3091"
    },
    {
      "type": "WEB",
      "url": "https://certvde.com/en/advisories/VDE-2025-035"
    },
    {
      "type": "WEB",
      "url": "https://certvde.com/en/advisories/VDE-2025-038"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-59562"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-22T19:16:24Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS Academy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Academy LMS: from n/a through 3.3.4.",
  "id": "GHSA-3p7c-45px-fv4v",
  "modified": "2026-04-01T18:36:18Z",
  "published": "2025-09-22T21:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59562"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/academy/vulnerability/wordpress-academy-lms-plugin-3-3-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pgadmin4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-1707"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-05T21:43:48Z",
    "nvd_published_at": "2026-02-05T18:16:11Z",
    "severity": "HIGH"
  },
  "details": "pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract the `\\restrict` key in real time, and race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `\\unrestrict \u003ckey\u003e`. This results in reliable command execution on the pgAdmin host during the restore operation.",
  "id": "GHSA-3p7x-94q9-jq9x",
  "modified": "2026-02-05T21:43:48Z",
  "published": "2026-02-05T18:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1707"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgadmin-org/pgadmin4/issues/9518"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pgadmin-org/pgadmin4/commit/62e2d18b0261f88086db65059a6078db07169f18"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pgadmin-org/pgadmin4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-87047"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T03:17:26Z",
    "severity": "MODERATE"
  },
  "details": "Tanium addressed an improper access controls vulnerability in Comply.",
  "id": "GHSA-3pc6-5vx3-vf24",
  "modified": "2026-09-09T03:30:47Z",
  "published": "2026-09-09T03:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87047"
    },
    {
      "type": "WEB",
      "url": "https://security.tanium.com/TAN-2026-038"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.10.0"
            },
            {
              "fixed": "0.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-87997"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-10T15:10:04Z",
    "nvd_published_at": "2026-09-09T22:18:48Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nThe chat-completions endpoint reads a folder id out of the request body and saves the newly created chat into that folder without checking that the caller is allowed to write there. Any authenticated user who knows a folder\u0027s id can put a chat of their own into another user\u0027s folder, including a shared folder where they hold read-only access and a folder they have no access to at all. The chat then shows up in that folder for everyone who can read it, under a title and with content the attacker controls. The dedicated chat-creation and chat-move endpoints already enforced this check, the chat-completions path did not.\n\n## Preconditions\n- An authenticated account of any role. No elevated permission, no admin involvement.\n- Folders enabled, which is the default (`ENABLE_FOLDERS=true`, `USER_PERMISSIONS_FEATURES_FOLDERS=true`).\n- The attacker needs the target folder\u0027s id. A member of a shared folder gets it from the shared-folder listing. Sharing a folder with named users is available to ordinary users by default; only wildcard public sharing is gated. A folder that was never shared has an id the attacker cannot obtain through any endpoint available to them, so those folders are not practically reachable.\n- Releases before 0.10.0 contain the same missing check but have no read path that lists a folder\u0027s chats across owners, so the injected row was never visible to anyone.\n\n## Impact\nThe integrity of folder contents. An attacker who cannot write to a folder can place chats into it, and every member with read access, the owner included, sees the entry with the attacker\u0027s display name and a title the attacker can change to arbitrary text at any time. Members can also open the injected chat and read its messages. In a workspace where a shared folder is treated as trusted, that is a usable surface for planting misleading or phishing content under another team\u0027s nose.\n\nNothing is disclosed to the attacker and nothing existing is altered. Writing into a folder grants no read access to it, so the attacker still cannot list or open the folder\u0027s other chats, and no data belonging to other users can be modified or deleted through this path. Availability is unaffected.\n\n## Fix\nFixed in 0.11.1 by https://github.com/open-webui/open-webui/pull/28366. Chat creation, chat moves and the chat-completions creation path now share a single folder write-access check, so a folder id the caller cannot write to is rejected everywhere a chat\u0027s folder can be set. Upgrading to 0.11.1 resolves it completely, with no configuration change required.\n\n## Root cause\nAffected component: the chat-completions handler in `backend/open_webui/main.py`, reached through `POST /api/chat/completions` and `POST /api/v1/chat/completions`. Affected setup: every deployment on 0.10.0 through 0.11.0 with folders enabled.\n\nThe completions handler gained its own chat-creation branch, which copied the client-supplied folder id into the chat it saved. The ownership and shared-write check lived as duplicated inline code inside the two chat routers rather than in one shared helper, so a third place that learned to set a folder id inherited none of it. Separately, folder listings had been changed to return a folder\u0027s chats across all owners so that shared folders work at all, which turned a write that used to be invisible to everyone into one the whole folder can see.\n\n## Proof of concept\nReproduced on a running instance at 0.11.0 with three accounts: one administrator and two ordinary users, one acting as victim and one as attacker.\n\n1. The victim creates a folder. The attacker is given no access to it: reading the folder returns 404 and listing its chats returns 403.\n2. The attacker sends `POST /api/v1/chats/new` with the victim\u0027s folder id. Rejected with 404, which is the pre-existing guard working.\n3. The attacker sends `POST /api/chat/completions` with `parent_id: null`, no chat id, and the victim\u0027s folder id in the body. Accepted.\n4. The victim lists their own folder and sees a chat owned by \"Attacker\". The victim can open it and read its messages. The attacker then renames their own chat and the new title appears verbatim in the victim\u0027s folder listing.\n\nRepeating step 3 with the attacker granted read-only access to a shared folder also succeeds on 0.11.0. On 0.11.1 both variants are rejected with 404 and the folder stays empty, while a member holding write access can still create chats there as intended.\n\nThe three accounts and the folder were created through the normal API. Nothing was written directly to the database.\n\n## Credits\nwhyiug, for reporting the missing folder write-access check on the chat-completions creation path.",
  "id": "GHSA-3pf7-q2g3-wj28",
  "modified": "2026-09-10T15:10:04Z",
  "published": "2026-09-10T15:10:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3pf7-q2g3-wj28"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87997"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/pull/28366"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/d9e23b90c100d19b00270aea3cde0501d2354a6c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Any authenticated user can inject chats into another user\u0027s folder via chat completions"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1"
            },
            {
              "fixed": "2.1.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2"
            },
            {
              "fixed": "2.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3"
            },
            {
              "fixed": "2.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-7890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-17T20:40:16Z",
    "nvd_published_at": "2019-08-02T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.",
  "id": "GHSA-3pgc-7jf3-5x5g",
  "modified": "2024-02-12T11:32:11Z",
  "published": "2022-05-24T16:52:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7890"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7890.yaml"
    },
    {
      "type": "WEB",
      "url": "https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Magento 2 Community Edition IDOR Vulnerability"
}