CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4570 vulnerabilities reference this CWE, most recent first.
GHSA-4VCF-Q4XF-F48M
Vulnerability from github – Published: 2025-11-25 21:42 – Updated: 2025-11-25 21:42Summary
Affected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using POST /passkey/delete-passkey.
Details
ctx.body.id is implicitly trusted and used in passkey deletion queries.
better-auth applications configured with useNumberId may use auto incrementing IDs which makes it trivial to delete all passkeys via enumeration.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@better-auth/passkey"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-25T21:42:53Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "# Summary\n\nAffected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using `POST /passkey/delete-passkey`.\n\n# Details\n\n`ctx.body.id` is implicitly trusted and used in passkey deletion queries.\n\nbetter-auth applications configured with `useNumberId` may use auto incrementing IDs which makes it trivial to delete all passkeys via enumeration.",
"id": "GHSA-4vcf-q4xf-f48m",
"modified": "2025-11-25T21:42:53Z",
"published": "2025-11-25T21:42:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m"
},
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/commit/06d68239e"
},
{
"type": "PACKAGE",
"url": "https://github.com/better-auth/better-auth"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Better Auth Passkey Plugin allows passkey deletion through IDOR"
}
GHSA-4VP3-JQP3-FQXC
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2023-03-03 15:30In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account.
{
"affected": [],
"aliases": [
"CVE-2019-14245"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-21T19:15:00Z",
"severity": "MODERATE"
},
"details": "In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account.",
"id": "GHSA-4vp3-jqp3-fqxc",
"modified": "2023-03-03T15:30:24Z",
"published": "2022-05-24T16:54:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14245"
},
{
"type": "WEB",
"url": "https://centos-webpanel.com/changelog-cwp7"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154155/CentOS-Control-Web-Panel-CWP-0.9.8.851-Arbitrary-Database-Drop.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154155/CentOS-WebPanel.com-CentOS-Control-Web-Panel-CWP-0.9.8.851-Arbitrary-Database-Drop.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154155/CentOS-WebPanel.com-Control-Web-Panel-CWP-0.9.8.851-Arbitrary-Database-Drop.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4VPG-X7MH-3947
Vulnerability from github – Published: 2026-08-11 12:30 – Updated: 2026-08-11 12:30An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.
{
"affected": [],
"aliases": [
"CVE-2026-72545"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T12:17:39Z",
"severity": "HIGH"
},
"details": "An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.",
"id": "GHSA-4vpg-x7mh-3947",
"modified": "2026-08-11T12:30:24Z",
"published": "2026-08-11T12:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72545"
},
{
"type": "WEB",
"url": "https://github.com/OpenSignLabs/OpenSign"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4VQ2-QQ4M-VP5X
Vulnerability from github – Published: 2026-02-03 15:30 – Updated: 2026-02-03 18:30Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through <= 3.4.0.
{
"affected": [],
"aliases": [
"CVE-2026-24991"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-03T15:16:18Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through \u003c= 3.4.0.",
"id": "GHSA-4vq2-qq4m-vp5x",
"modified": "2026-02-03T18:30:43Z",
"published": "2026-02-03T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24991"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/extensions-for-cf7/vulnerability/wordpress-extensions-for-cf7-plugin-3-4-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4VRC-P2PF-P4QJ
Vulnerability from github – Published: 2026-09-02 06:31 – Updated: 2026-09-02 12:31The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
{
"affected": [],
"aliases": [
"CVE-2026-77788"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-02T06:17:17Z",
"severity": "MODERATE"
},
"details": "The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.",
"id": "GHSA-4vrc-p2pf-p4qj",
"modified": "2026-09-02T12:31:28Z",
"published": "2026-09-02T06:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77788"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/c02511a0-9c8b-44cd-b25f-e95cf5f9fef3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4VRR-RHF8-CPC9
Vulnerability from github – Published: 2026-09-16 15:31 – Updated: 2026-09-17 21:31ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass
Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR's built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body.
This is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.
{
"affected": [],
"aliases": [
"CVE-2026-84860"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-16T15:18:00Z",
"severity": "HIGH"
},
"details": "ScadaLTS 2.8.1-release-candidate build 0 is affected by an\u00a0Authorization Bypass\n\n\n\nSpring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR\u0027s built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body.\n\n\n\nThis is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.",
"id": "GHSA-4vrr-rhf8-cpc9",
"modified": "2026-09-17T21:31:35Z",
"published": "2026-09-16T15:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84860"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2026-60"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4W3X-69M8-478C
Vulnerability from github – Published: 2026-07-24 15:33 – Updated: 2026-07-24 15:33A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.
{
"affected": [],
"aliases": [
"CVE-2026-17059"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-24T15:17:13Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access.",
"id": "GHSA-4w3x-69m8-478c",
"modified": "2026-07-24T15:33:02Z",
"published": "2026-07-24T15:33:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17059"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-17059"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506746"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4W6R-5C2J-QF5F
Vulnerability from github – Published: 2026-06-05 16:03 – Updated: 2026-07-20 21:19Summary
Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base.
Details
A new sanitizeListArgsForPublicView helper now strips request keys that should
never be caller-controlled (e.g. getHiddenColumn, nested), parses where
clauses against a restricted alias map that only contains visible columns, and
recursively removes filter/sort entries whose fk_column_id is not in the visible
set. validateGroupByColumnNames and validateGroupColumnId reject groupBy
requests whose column_name (CSV-style) or groupColumnId is not in the visible
or group-by column set. relDataList now checks column.fk_model_id ===
currentModel.id before resolving the linked table, matching the pre-existing
check on publicMmList and publicHmList.
Impact
Anyone with a shared-view UUID could enumerate hidden-column values directly (via groupBy), confirm hidden-column values by observing row counts (via filter), or read records from unrelated tables in the same base (via the related-data list). No authentication was required.
Credit
This issue was reported by @0xBassia. It was independently reported by @b-hermes.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nocodb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.04.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47378"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-05T16:03:11Z",
"nvd_published_at": "2026-06-23T21:16:59Z",
"severity": "MODERATE"
},
"details": "### Summary\nPublic shared-view endpoints exposed values from columns that the view owner had\nhidden, via three independent paths: groupBy returned raw values for any column\nnamed in the request, filter and sort arrays operated on hidden columns enabling\nboolean-blind extraction, and the related-data list accepted arbitrary link-column\nIDs from other tables in the same base.\n\n### Details\nA new `sanitizeListArgsForPublicView` helper now strips request keys that should\nnever be caller-controlled (e.g. `getHiddenColumn`, `nested`), parses `where`\nclauses against a restricted alias map that only contains visible columns, and\nrecursively removes filter/sort entries whose `fk_column_id` is not in the visible\nset. `validateGroupByColumnNames` and `validateGroupColumnId` reject groupBy\nrequests whose `column_name` (CSV-style) or `groupColumnId` is not in the visible\nor group-by column set. `relDataList` now checks `column.fk_model_id ===\ncurrentModel.id` before resolving the linked table, matching the pre-existing\ncheck on `publicMmList` and `publicHmList`.\n\n### Impact\nAnyone with a shared-view UUID could enumerate hidden-column values directly (via\ngroupBy), confirm hidden-column values by observing row counts (via filter), or\nread records from unrelated tables in the same base (via the related-data list).\nNo authentication was required.\n\n### Credit\nThis issue was reported by [@0xBassia](https://github.com/0xBassia).\nIt was independently reported by [@b-hermes](https://github.com/b-hermes).",
"id": "GHSA-4w6r-5c2j-qf5f",
"modified": "2026-07-20T21:19:44Z",
"published": "2026-06-05T16:03:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-4w6r-5c2j-qf5f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47378"
},
{
"type": "PACKAGE",
"url": "https://github.com/nocodb/nocodb"
},
{
"type": "WEB",
"url": "https://github.com/nocodb/nocodb/releases/tag/2026.04.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "NocoDB: Hidden Column Exposure in Public Shared View Endpoints"
}
GHSA-4W94-X732-JCMM
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-03-26 15:30Authorization Bypass Through User-Controlled Key vulnerability in LatePoint LatePoint latepoint allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LatePoint: from n/a through <= 5.2.6.
{
"affected": [],
"aliases": [
"CVE-2026-32533"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T17:17:06Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in LatePoint LatePoint latepoint allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LatePoint: from n/a through \u003c= 5.2.6.",
"id": "GHSA-4w94-x732-jcmm",
"modified": "2026-03-26T15:30:34Z",
"published": "2026-03-25T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32533"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/latepoint/vulnerability/wordpress-latepoint-plugin-5-2-6-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4WH7-QF8P-938F
Vulnerability from github – Published: 2025-10-27 15:30 – Updated: 2025-10-27 15:30A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User Profile Handler. Performing manipulation results in authorization bypass. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-12288"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-27T15:15:37Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User Profile Handler. Performing manipulation results in authorization bypass. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-4wh7-qf8p-938f",
"modified": "2025-10-27T15:30:42Z",
"published": "2025-10-27T15:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12288"
},
{
"type": "WEB",
"url": "https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12288.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.329956"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.329956"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.674883"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.