CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4320 vulnerabilities reference this CWE, most recent first.
GHSA-83MC-F7WH-6HXJ
Vulnerability from github – Published: 2026-07-21 21:32 – Updated: 2026-07-21 21:32Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments — such as those associated with Security Solution cases — without holding the privileges required to access those features.
{
"affected": [],
"aliases": [
"CVE-2026-56147"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T21:16:52Z",
"severity": "HIGH"
},
"details": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana\u0027s file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments \u2014 such as those associated with Security Solution cases \u2014 without holding the privileges required to access those features.",
"id": "GHSA-83mc-f7wh-6hxj",
"modified": "2026-07-21T21:32:42Z",
"published": "2026-07-21T21:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56147"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/kibana-8-19-18-9-3-7-9-4-3-security-update-esa-2026-59/388558"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-83X8-HVHG-CVG7
Vulnerability from github – Published: 2023-04-04 18:30 – Updated: 2023-04-12 15:30The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute.
{
"affected": [],
"aliases": [
"CVE-2023-1749"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-04T17:15:00Z",
"severity": "MODERATE"
},
"details": "The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute.",
"id": "GHSA-83x8-hvhg-cvg7",
"modified": "2023-04-12T15:30:45Z",
"published": "2023-04-04T18:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1749"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-842V-GV8W-XP7C
Vulnerability from github – Published: 2026-01-09 09:31 – Updated: 2026-01-09 09:31Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communication between the affected product and its user, and some crafted request is processed by the product, the user's registration information and/or OIDC (OpenID Connect) tokens may be retrieved.
{
"affected": [],
"aliases": [
"CVE-2026-21409"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-09T08:15:58Z",
"severity": "HIGH"
},
"details": "Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communication between the affected product and its user, and some crafted request is processed by the product, the user\u0027s registration information and/or OIDC (OpenID Connect) tokens may be retrieved.",
"id": "GHSA-842v-gv8w-xp7c",
"modified": "2026-01-09T09:31:20Z",
"published": "2026-01-09T09:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21409"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN12770174"
},
{
"type": "WEB",
"url": "https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-843M-RFXF-6V2G
Vulnerability from github – Published: 2026-06-12 18:31 – Updated: 2026-06-12 18:31A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.
{
"affected": [],
"aliases": [
"CVE-2026-8828"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-12T16:16:34Z",
"severity": "HIGH"
},
"details": "A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant\u0027s collection regardless of which tenant they belong to.",
"id": "GHSA-843m-rfxf-6v2g",
"modified": "2026-06-12T18:31:59Z",
"published": "2026-06-12T18:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8828"
},
{
"type": "WEB",
"url": "https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8459-9GRP-5W5J
Vulnerability from github – Published: 2024-07-09 12:30 – Updated: 2024-07-09 12:30A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a high privileged user (admin). This results in unauthorized access and unauthorized data manipulation.
{
"affected": [],
"aliases": [
"CVE-2023-38052"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-09T11:15:11Z",
"severity": "CRITICAL"
},
"details": "A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a high privileged user (admin). This results in unauthorized access and unauthorized data manipulation.",
"id": "GHSA-8459-9grp-5w5j",
"modified": "2024-07-09T12:30:56Z",
"published": "2024-07-09T12:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38052"
},
{
"type": "WEB",
"url": "https://github.com/alextselegidis/easyappointments"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-848M-R628-VRXW
Vulnerability from github – Published: 2026-09-04 20:07 – Updated: 2026-09-04 20:07An authenticated user scoped to one namespace/database could invoke a custom API (DEFINE API) belonging to a different namespace/database, reaching another tenant's endpoint.
The route /api/{namespace}/{database}/{endpoint} took the namespace and database from the URL and applied them to the caller's session before the endpoint was looked up or run, without checking that the caller's authenticated scope covered them. Because a custom API handler runs with permissions disabled (definer's rights), the endpoint's own PERMISSIONS clause was the only gate — open to everyone for a PERMISSIONS FULL endpoint. The api::invoke() function was affected the same way, resolving against the session's selected namespace/database (settable via the surreal-ns / surreal-db headers or USE).
Impact
What an attacker can do:
- With valid credentials for any one namespace/database (a
VIEWERis enough), invoke a custom API in another namespace/database by naming the victim scope in the URL. - Read data that endpoint returns — including from
PERMISSIONS NONEtables, since the handler runs with permissions disabled — or trigger any writes and side effects it performs.
What it can't do:
- Reach a scope without valid credentials for some namespace/database on the instance; this is not an unauthenticated bypass.
- Affect single-tenant deployments, or any deployment where callers already hold instance-wide (root) scope.
Patches
The namespace/database is now validated against the caller's authenticated level — which the request cannot change — before the endpoint is resolved or run. A target scope outside that level is rejected with 403 Forbidden, both at the HTTP entry point and at the dispatch step shared with api::invoke(). Root reaches any scope; namespace principals their namespace; database and record principals their exact namespace/database; anonymous callers remain governed by the endpoint's PERMISSIONS.
- Versions 3.2.0 and later are not affected by this issue.
Workarounds
Users unable to patch should consider the following workarounds:
- Disable the custom API HTTP route via capabilities where it is not required.
- Treat separate deployments, not namespace/database boundaries, as the tenant isolation boundary on shared instances.
- Prefer a
PERMISSIONS WHEREclause that checks the authenticated identity overPERMISSIONS FULL(reduces exposure but does not restore the boundary).
Resources
- SurrealQL Documentation — DEFINE API
- SurrealDB Documentation — Capabilities
fix(core/api): reject cross-tenant custom API access(included in SurrealDB 3.2.0)
Acknowledgements
SurrealDB thanks sondt99 for reporting this issue.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-63735"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-04T20:07:07Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "An authenticated user scoped to one namespace/database could invoke a custom API (`DEFINE API`) belonging to a different namespace/database, reaching another tenant\u0027s endpoint.\n\nThe route `/api/{namespace}/{database}/{endpoint}` took the namespace and database from the URL and applied them to the caller\u0027s session before the endpoint was looked up or run, without checking that the caller\u0027s authenticated scope covered them. Because a custom API handler runs with permissions disabled (definer\u0027s rights), the endpoint\u0027s own `PERMISSIONS` clause was the only gate \u2014 open to everyone for a `PERMISSIONS FULL` endpoint. The `api::invoke()` function was affected the same way, resolving against the session\u0027s selected namespace/database (settable via the `surreal-ns` / `surreal-db` headers or `USE`).\n\n### Impact\n\nWhat an attacker **can** do:\n\n- With valid credentials for any one namespace/database (a `VIEWER` is enough), invoke a custom API in another namespace/database by naming the victim scope in the URL.\n- Read data that endpoint returns \u2014 including from `PERMISSIONS NONE` tables, since the handler runs with permissions disabled \u2014 or trigger any writes and side effects it performs.\n\nWhat it **can\u0027t** do:\n\n- Reach a scope without valid credentials for some namespace/database on the instance; this is not an unauthenticated bypass.\n- Affect single-tenant deployments, or any deployment where callers already hold instance-wide (root) scope.\n\n### Patches\n\nThe namespace/database is now validated against the caller\u0027s authenticated level \u2014 which the request cannot change \u2014 before the endpoint is resolved or run. A target scope outside that level is rejected with `403 Forbidden`, both at the HTTP entry point and at the dispatch step shared with `api::invoke()`. Root reaches any scope; namespace principals their namespace; database and record principals their exact namespace/database; anonymous callers remain governed by the endpoint\u0027s `PERMISSIONS`.\n\n- Versions 3.2.0 and later are not affected by this issue.\n\n### Workarounds\n\nUsers unable to patch should consider the following workarounds:\n\n- Disable the custom API HTTP route via capabilities where it is not required.\n- Treat separate deployments, not namespace/database boundaries, as the tenant isolation boundary on shared instances.\n- Prefer a `PERMISSIONS WHERE` clause that checks the authenticated identity over `PERMISSIONS FULL` (reduces exposure but does not restore the boundary).\n\n### Resources\n\n- [SurrealQL Documentation \u2014 DEFINE API](https://surrealdb.com/docs/surrealql/statements/define/api)\n- [SurrealDB Documentation \u2014 Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities)\n- `fix(core/api): reject cross-tenant custom API access` (included in SurrealDB 3.2.0)\n\n### Acknowledgements\n\nSurrealDB thanks [sondt99](https://github.com/sondt99) for reporting this issue.",
"id": "GHSA-848m-r628-vrxw",
"modified": "2026-09-04T20:07:07Z",
"published": "2026-09-04T20:07:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-848m-r628-vrxw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63735"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/commit/0938f88d196dc4eb11a82af343df3fffe9c195e2"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/commit/75b7154f84904d047619b5a47b08d256254dceca"
},
{
"type": "PACKAGE",
"url": "https://github.com/surrealdb/surrealdb"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-custom-api"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path"
}
GHSA-849Q-F682-346F
Vulnerability from github – Published: 2023-02-21 09:30 – Updated: 2023-03-02 18:30The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.
{
"affected": [],
"aliases": [
"CVE-2023-0453"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-21T09:15:00Z",
"severity": "MODERATE"
},
"details": "The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.",
"id": "GHSA-849q-f682-346f",
"modified": "2023-03-02T18:30:29Z",
"published": "2023-02-21T09:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0453"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/superio-job-board-wordpress-theme/32180231"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/f915e5ac-e216-4d1c-aec1-c3be11e2a6de"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-84C5-87QC-6GP9
Vulnerability from github – Published: 2024-06-22 06:30 – Updated: 2024-06-22 06:30The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify posts and pages created by other users including admins. As a requirement for this, an admin would have to enable access to the editor specifically for such a user or enable it for all users with a certain user account type.
{
"affected": [],
"aliases": [
"CVE-2024-4874"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-22T05:15:11Z",
"severity": "MODERATE"
},
"details": "The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify posts and pages created by other users including admins. As a requirement for this, an admin would have to enable access to the editor specifically for such a user or enable it for all users with a certain user account type.",
"id": "GHSA-84c5-87qc-6gp9",
"modified": "2024-06-22T06:30:37Z",
"published": "2024-06-22T06:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4874"
},
{
"type": "WEB",
"url": "https://bricksbuilder.io/release/bricks-1-9-9/#access-control-fix-for-user-role-contributor"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d63e898-43e5-42b5-96b6-1453352e0cae?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-84C8-QPCC-7WF9
Vulnerability from github – Published: 2023-07-17 15:30 – Updated: 2024-04-04 06:10Authorization Bypass Through User-Controlled Key vulnerability in Origin Software ATS Pro allows Authentication Abuse, Authentication Bypass.This issue affects ATS Pro: before 20230714.
{
"affected": [],
"aliases": [
"CVE-2023-2958"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-17T15:15:09Z",
"severity": "CRITICAL"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Origin Software ATS Pro allows Authentication Abuse, Authentication Bypass.This issue affects ATS Pro: before 20230714.\n\n",
"id": "GHSA-84c8-qpcc-7wf9",
"modified": "2024-04-04T06:10:20Z",
"published": "2023-07-17T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2958"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-23-0410"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-84FW-WVQ7-7X27
Vulnerability from github – Published: 2022-05-13 01:38 – Updated: 2022-05-13 01:38Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user.
{
"affected": [],
"aliases": [
"CVE-2017-0936"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-28T20:29:00Z",
"severity": "MODERATE"
},
"details": "Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user.",
"id": "GHSA-84fw-wvq7-7x27",
"modified": "2022-05-13T01:38:23Z",
"published": "2022-05-13T01:38:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0936"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/297751"
},
{
"type": "WEB",
"url": "https://nextcloud.com/security/advisory/?id=nc-sa-2018-001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.