CWE-639

{
  "affected": [],
  "aliases": [
    "CVE-2024-1626"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-250",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-16T00:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, within the project update endpoint. The vulnerability allows authenticated users to modify the name of any project within the system without proper authorization checks, by directly referencing the project\u0027s ID in the PATCH request to the \u0027/v1/projects/:projectId\u0027 endpoint. This issue arises because the endpoint does not verify if the provided project ID belongs to the currently authenticated user, enabling unauthorized modifications across different organizational projects.",
  "id": "GHSA-4x7q-prxg-7hxw",
  "modified": "2024-04-16T00:30:33Z",
  "published": "2024-04-16T00:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1626"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lunary-ai/lunary/commit/9eb9e526edff8bf82ae032f7a04867c8d58572bc"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/ccc291db-ae9c-403c-b6b5-6fe3f4800933"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0337"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-06T17:15:22Z",
    "severity": "HIGH"
  },
  "details": "ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access. \n\nThis issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners.",
  "id": "GHSA-4x8m-chwm-9h7p",
  "modified": "2025-03-06T18:31:11Z",
  "published": "2025-03-06T18:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0337"
    },
    {
      "type": "WEB",
      "url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1948695"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-103446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-30T18:18:17Z",
    "severity": "HIGH"
  },
  "details": "Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.\n\nThis issue affects MediaWiki WikiLambda extension: 1.46.",
  "id": "GHSA-4x94-p99h-wrcj",
  "modified": "2026-09-30T18:33:50Z",
  "published": "2026-09-30T18:33:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103446"
    },
    {
      "type": "WEB",
      "url": "https://gerrit.wikimedia.org/r/q/If2c05b109672fc65f63372f86c768859dc6639fd"
    },
    {
      "type": "WEB",
      "url": "https://phabricator.wikimedia.org/T435086"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "dolibarr/dolibarr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-03T22:06:43Z",
    "nvd_published_at": "2022-02-23T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Dolibarr allows improper access control issues in the userphoto modulepart. The impact could lead to data exposure as the attached files and documents may contain sensitive information of relevant parties such as contacts, suppliers, invoices, orders, stocks, agenda, accounting and more.",
  "id": "GHSA-4xc7-x2jr-cr74",
  "modified": "2022-03-03T22:06:43Z",
  "published": "2022-02-24T00:00:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0731"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dolibarr/dolibarr/commit/209ab708d4b65fbd88ba4340d60b7822cb72651a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dolibarr/dolibarr"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/e242ab4e-fc70-4b2c-a42d-5b3ee4895de8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Authorization in dolibarr/dolibarr"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "django-cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54622"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:42:11Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n  The clipboard copy paths of the `copy_plugins` admin endpoint validate only   the target (the user\u0027s own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on   into their clipboard, then read the (secret) content.\n\n  ### Details\n  In `cms/admin/placeholderadmin.py`, `_copy_plugin_to_clipboard` and   `_copy_placeholder_to_clipboard` check `has_copy_plugins_permission`, which only  evaluates `request.toolbar.clipboard.has_add_plugins_permission(...)` \u2014 the\n  clipboard belongs to the requesting user, and `check_source` is likewise  applied only to the clipboard. The source placeholder identified by the  attacker-supplied `source_placeholder_id` / `source_plugin_id` is never  authorization-checked. (The placeholder-to-placeholder copy path,  `has_copy_from_placeholder_permission`, correctly checks both sides.)\n\n  ### Impact\n  A staff user holding the global add permission for a plugin type, but with no  access to a given placeholder/page, can copy that placeholder\u0027s plugins into  their own clipboard and read content (e.g. link names/URLs, text) they cannot  reach through the normal edit endpoints.\n\n  Requires `CMS_PERMISSION=True` with per-placeholder/page restrictions.\n\n  ### Patches\n  Fixed in 5.0.8: the clipboard copy paths now also verify   source-side permission (`has_add_plugins_permission` + `check_source` on the  source placeholder), matching placeholder-to-placeholder copy.\n\n  ### Workarounds\n  None. Upgrade is recommended.\n\n  ### Credits\n  Reported by the security team at the University of Sydney ([@reporter]).",
  "id": "GHSA-4xfr-4p46-gc6p",
  "modified": "2026-08-20T18:42:11Z",
  "published": "2026-08-20T18:42:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-4xfr-4p46-gc6p"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/pull/8645"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/django-cms/django-cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "django CMS: Clipboard copy IDOR discloses unauthorized plugin content"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-67985"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-16T09:16:00Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Document Library Lite: from n/a through \u003c= 1.1.7.",
  "id": "GHSA-4xq4-24ch-xr3q",
  "modified": "2026-01-20T15:32:16Z",
  "published": "2025-12-16T09:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67985"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/document-library-lite/vulnerability/wordpress-document-library-lite-plugin-1-1-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/document-library-lite/vulnerability/wordpress-document-library-lite-plugin-1-1-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-3610"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-06T03:15:17Z",
    "severity": "HIGH"
  },
  "details": "The Reales WP STPT plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.1.2. This is due to the plugin not properly validating a user\u0027s identity prior to updating their details like password. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user\u0027s passwords and email addresses, including administrators, and leverage that to gain access to their account. This can be combined with CVE-2025-3609 to achieve remote code execution as an originally unauthenticated user with no account.",
  "id": "GHSA-52cj-q87r-f28w",
  "modified": "2025-05-06T03:30:24Z",
  "published": "2025-05-06T03:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3610"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/reales-wp-real-estate-wordpress-theme/10330568"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38c6b149-39d7-491a-9f3a-261087a52a03?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openchoreo/openchoreo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.0-m.1"
            },
            {
              "fixed": "1.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openchoreo/openchoreo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73841"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T23:44:51Z",
    "nvd_published_at": "2026-08-13T22:17:28Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe OpenChoreo API server (`openchoreo-api`) authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the authorization engine decided purely from the caller-supplied resource hierarchy \u2014 the component\u0027s real owning project was never checked. As a result, an authenticated user who holds a project-scoped exec or log-viewing grant on any single project could run commands in, and read the wirelogs of, components owned by other projects in the same namespace.\n\n### Impact\n\nAn authenticated tenant holding a project-scoped `component:exec` grant on just one project can execute arbitrary commands \u2014 including an interactive shell \u2014 inside the running pods of components owned by any other project in the same namespace. This exposes those workloads\u0027 environment variables and mounted Secrets (such as database credentials, API keys, and tokens), allows tampering with the workload, and enables further pivoting using the workload\u0027s own network position and credentials. The same flaw in the wirelogs endpoint lets a project-scoped `wirelogs:view` grant read any component\u0027s wirelogs in the namespace.\n\nThe blast radius is every component in the namespace, reachable from a single legitimate project grant. The boundary crossed is project-within-namespace: the request still pins the namespace, so the issue does not cross namespace boundaries. In effect this is a cross-project (cross-team) remote command-execution and data-access primitive available to any low-privileged tenant.\n\n### Patches\n\nFixed in **1.2.3** and **1.1.6**. The fix aligns the exec and wirelogs endpoints with the pattern already used by other first-class component operations: the target component is fetched first and authorization is evaluated against its real owning project (`comp.Spec.Owner.ProjectName`) instead of the caller-supplied `project` query parameter.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Restrict `component:exec` and `wirelogs:view` grants to trusted operators only. Any holder of such a grant on any project can reach every component in the same namespace.\n- Where stronger isolation is required, separate sensitive components into their own namespaces, since the flaw does not cross namespace boundaries.\n\n### Related advisories\n\n- `GHSA-rh53-xvx2-j327` \u2014 the cluster-gateway internal proxy applies no caller authorization, so this API-layer authorization bypass reaches the data-plane Kubernetes API with no compensating control: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327\n- `GHSA-c5f6-2rm9-2w8g` \u2014 reported together as part of the same review.",
  "id": "GHSA-52gf-6rpq-fgmx",
  "modified": "2026-09-02T23:44:51Z",
  "published": "2026-09-02T23:44:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73841"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/pull/4251"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/pull/4516"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/pull/4538"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/commit/4d372eaf1f07525663dcca5257062f4b051b9820"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/commit/9d77b64f747eba89247c47ebfeffec591c4cd2d8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/commit/c9390e4fcb9953f43b07cb48197576182301593d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openchoreo/openchoreo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-87966"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-18T06:16:40Z",
    "severity": "MODERATE"
  },
  "details": "The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.",
  "id": "GHSA-52p7-4rrr-jvcv",
  "modified": "2026-09-18T12:31:15Z",
  "published": "2026-09-18T06:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87966"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/e2e625f4-c146-4622-b439-3179c4484613"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.3.24"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.3.28"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35617"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-807",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-29T15:48:15Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\nGoogle Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `\u003c= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nGoogle Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit `11ea1f67863d88b6cbcb229dd368a45e07094bff` requires stable group IDs for access decisions.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `11ea1f67863d88b6cbcb229dd368a45e07094bff`.\n\n## Fix Commit(s)\n\n- `11ea1f67863d88b6cbcb229dd368a45e07094bff`",
  "id": "GHSA-52q4-3xjc-6778",
  "modified": "2026-04-18T00:48:38Z",
  "published": "2026-03-29T15:48:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-52q4-3xjc-6778"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35617"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/11ea1f67863d88b6cbcb229dd368a45e07094bff"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-group-policy-rebinding-with-mutable-space-displayname"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName"
}