CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3256 vulnerabilities reference this CWE, most recent first.
GHSA-QJGJ-875G-MQ5Q
Vulnerability from github – Published: 2026-02-10 09:30 – Updated: 2026-02-10 09:30An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.
{
"affected": [],
"aliases": [
"CVE-2025-12063"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T07:16:12Z",
"severity": "MODERATE"
},
"details": "An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.",
"id": "GHSA-qjgj-875g-mq5q",
"modified": "2026-02-10T09:30:26Z",
"published": "2026-02-10T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12063"
},
{
"type": "WEB",
"url": "https://www.axis.com/dam/public/bc/f0/5a/cve-2025-12063pdf-en-US-519288.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJQ2-685Q-J8GV
Vulnerability from github – Published: 2026-07-07 06:31 – Updated: 2026-07-07 06:31MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.
This issue affects MicroRealEstate: through 1.0.0-alpha3.
{
"affected": [],
"aliases": [
"CVE-2026-57868"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-07T06:16:22Z",
"severity": "HIGH"
},
"details": "MicroRealEstate is affected by broken object-level access controls in PDF generator functionality.\n\nThis issue affects MicroRealEstate: through 1.0.0-alpha3.",
"id": "GHSA-qjq2-685q-j8gv",
"modified": "2026-07-07T06:31:24Z",
"published": "2026-07-07T06:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57868"
},
{
"type": "WEB",
"url": "https://github.com/microrealestate/microrealestate"
},
{
"type": "WEB",
"url": "https://www.themissinglink.com.au/security-advisories/cve-2026-57868"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QJQ8-C6GX-G7MG
Vulnerability from github – Published: 2026-05-07 09:31 – Updated: 2026-05-07 09:31Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0.
{
"affected": [],
"aliases": [
"CVE-2026-27329"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-07T09:16:27Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0.",
"id": "GHSA-qjq8-c6gx-g7mg",
"modified": "2026-05-07T09:31:27Z",
"published": "2026-05-07T09:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27329"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/yith-woocommerce-wishlist/vulnerability/wordpress-yith-woocommerce-wishlist-plugin-4-12-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QM65-G2FH-9P2W
Vulnerability from github – Published: 2025-01-30 15:31 – Updated: 2025-01-30 15:31The Typer Core plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.6 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
{
"affected": [],
"aliases": [
"CVE-2024-12102"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-30T14:15:31Z",
"severity": "MODERATE"
},
"details": "The Typer Core plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.6 via the \u0027elementor-template\u0027 shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.",
"id": "GHSA-qm65-g2fh-9p2w",
"modified": "2025-01-30T15:31:38Z",
"published": "2025-01-30T15:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12102"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/typer-core"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/de53b1d8-e38f-42c5-adfc-2b0ce8d6945b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QM72-8PRH-G92X
Vulnerability from github – Published: 2026-07-03 21:31 – Updated: 2026-07-07 18:30Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.
{
"affected": [],
"aliases": [
"CVE-2026-25782"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-03T21:16:58Z",
"severity": "MODERATE"
},
"details": "Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.",
"id": "GHSA-qm72-8prh-g92x",
"modified": "2026-07-07T18:30:34Z",
"published": "2026-07-03T21:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25782"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/pull/36664"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/pull/36689"
},
{
"type": "WEB",
"url": "https://blog.gitea.com/release-of-1.25.5"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QMFJ-76R4-VWG3
Vulnerability from github – Published: 2023-05-20 12:30 – Updated: 2024-04-04 04:15Authorization Bypass Through User-Controlled Key vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Authentication Abuse, Authentication Bypass.This issue affects Rental Module: before 23.05.15.
{
"affected": [],
"aliases": [
"CVE-2023-2713"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-20T10:15:09Z",
"severity": "CRITICAL"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in \"Rental Module\" developed by third-party for Ideasoft\u0027s E-commerce Platform allows Authentication Abuse, Authentication Bypass.This issue affects Rental Module: before 23.05.15.\n\n",
"id": "GHSA-qmfj-76r4-vwg3",
"modified": "2024-04-04T04:15:38Z",
"published": "2023-05-20T12:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2713"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-23-0276"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QMGP-3M36-HH24
Vulnerability from github – Published: 2022-10-01 00:00 – Updated: 2022-10-05 00:00Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.
{
"affected": [],
"aliases": [
"CVE-2021-36865"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-30T19:15:00Z",
"severity": "MODERATE"
},
"details": "Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin \u003c= 7.3.4 at WordPress allows attackers to change the content of the quiz.",
"id": "GHSA-qmgp-3m36-hh24",
"modified": "2022-10-05T00:00:38Z",
"published": "2022-10-01T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36865"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/quiz-master-next/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QPF8-2MC2-HVMH
Vulnerability from github – Published: 2026-04-29 09:30 – Updated: 2026-04-29 09:30This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.
{
"affected": [],
"aliases": [
"CVE-2026-42515"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-29T09:16:24Z",
"severity": "HIGH"
},
"details": "This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.",
"id": "GHSA-qpf8-2mc2-hvmh",
"modified": "2026-04-29T09:30:24Z",
"published": "2026-04-29T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42515"
},
{
"type": "WEB",
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2026-0207"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QPGW-J75C-J585
Vulnerability from github – Published: 2024-07-31 21:32 – Updated: 2024-08-15 15:30An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack.
{
"affected": [],
"aliases": [
"CVE-2024-41254"
],
"database_specific": {
"cwe_ids": [
"CWE-347",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T21:15:17Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack.",
"id": "GHSA-qpgw-j75c-j585",
"modified": "2024-08-15T15:30:52Z",
"published": "2024-07-31T21:32:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41254"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/d857f268a53aa62402655c8dcd95c68f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QPHR-3MVQ-V466
Vulnerability from github – Published: 2026-06-01 09:31 – Updated: 2026-07-09 21:03The Event Log detail endpoint GET /api/v2/eventLogs/{event_log_id} in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint GET /api/v2/eventLogs applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rely on per-Dag audit-log scoping. Users are advised to upgrade to apache-airflow 3.2.2 or later.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46764"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-09T21:03:42Z",
"nvd_published_at": "2026-06-01T09:16:20Z",
"severity": "MODERATE"
},
"details": "The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint `GET /api/v2/eventLogs` applied per-Dag scoping. An authenticated UI/API user with audit-log read permission for one Dag could retrieve audit-log entries for any other Dag by guessing or enumerating the numeric event log ID. Affects deployments that rely on per-Dag audit-log scoping. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.",
"id": "GHSA-qphr-3mvq-v466",
"modified": "2026-07-09T21:03:42Z",
"published": "2026-06-01T09:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46764"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/67112"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/ctrbj7q3m86g4qxmo9ponojgmzrcoqpv"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/31/14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Airflow has an Authorization Bypass Through User-Controlled Key"
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.