Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

3254 vulnerabilities reference this CWE, most recent first.

GHSA-R7V4-JWX9-WX43

Vulnerability from github – Published: 2022-06-06 21:21 – Updated: 2022-06-06 21:21
VLAI
Summary
Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator
Details

Background

CILogon is a federated auth provider that allows users to authenticate themselves via a number of Identity Providers (IdP), focused primarily on educational and research institutions (such as Universities). More traditional and open IdPs such as GitHub, ORCID, Google, Microsoft, etc are also supported.

CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowed_idps configuration trait of CILogonOAuthenticator is documented to be a list of domains that indicate the institutions whose users are authorized to access this JupyterHub. This authorization is validated by ensuring that the email field provided to us by CILogon has a domain that matches one of the domains listed in allowed_idps.

Impact

If allowed_idps contains berkeley.edu, you might expect only users with valid current credentials provided by University of California, Berkeley to be able to access the JupyterHub. However, CILogonOAuthenticator does not verify which provider is used by the user to login, only the email address provided. So a user can login with a GitHub account that has email set to <something>@berkeley.edu, and that will be treated exactly the same as someone logging in using the UC Berkeley official Identity Provider. This has two consequences:

  1. Since GitHub (and most other providers we tested) only require you to verify your email once, a user can access a JupyterHub even if their access to the institution's IdP has been revoked or expired.
  2. CILogon supports hundreds of identity providers - if even one of them allows users to set any email ids without verifying, that can be used to impersonate any user on any other identity provider! While CILogon itself has a stellar security record, this particular method of doing authorization means an attacker would only need to compromise a single identity provider to compromise all of CILogon

We currently do not know of any identity provider that provides unverified email addresses to CILogon, so this is not a severe known vulnerability. However, there are hundreds of IdPs, and we could not try them all.

Patches

This patch makes a breaking change in how allowed_idps is interpreted. It's no longer a list of domains, but configuration representing the EntityID of the IdPs that are allowed, picked from the list maintained by CILogon. So instead of berkeley.edu, you would specify urn:mace:incommon:berkeley.edu to allow logins from users currently with berkeley.edu accounts. GitHub users with a verified berkeley.edu email will no longer be allowed to log in.

For details on how to transition your CILogonOAuthenticator configuration to the patched version 15.0.0 or above, see the migration documentation.

Severity
4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "oauthenticator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31027"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-06T21:21:40Z",
    "nvd_published_at": "2022-06-09T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "# Background\n\nCILogon is a federated auth provider that allows users to authenticate\nthemselves via a number of Identity Providers (IdP), focused primarily on educational and\nresearch institutions (such as Universities). More traditional and open IdPs\nsuch as GitHub, ORCID, Google, Microsoft, etc are also supported.\n\nCILogonOAuthenticator is provided by the OAuthenticator package, and lets users log\nin to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub\nonly to users of a given institute. The allowed_idps configuration trait of\nCILogonOAuthenticator is documented to be a list of domains that indicate the\ninstitutions whose users are authorized to access this JupyterHub. This authorization\nis validated by ensuring that the *email* field provided to us by CILogon has a\n*domain* that matches one of the domains listed in `allowed_idps`.\n\n# Impact\n\nIf `allowed_idps` contains `berkeley.edu`, you might expect only users with valid\ncurrent credentials provided by University of California, Berkeley to be able to\naccess the JupyterHub. However, CILogonOAuthenticator does *not* verify which provider\nis used by the user to login, only the email address provided. So a user can login\nwith a GitHub account that has email set to `\u003csomething\u003e@berkeley.edu`, and that will\nbe treated exactly the same as someone logging in using the UC Berkeley official\nIdentity Provider. This has two consequences:\n\n1. Since GitHub (and most other providers we tested) only require you to verify\n   your email once, a user can access a JupyterHub even if their access to\n   the institution\u0027s IdP has been revoked or expired.\n2. CILogon supports hundreds of identity providers - if even one of them allows\n   users to set any email ids without verifying, that can be used to impersonate\n   *any* user on any other identity provider! While CILogon itself has a stellar\n   security record, this particular method of doing authorization means an attacker\n   would only need to compromise a single identity provider to compromise all of\n   CILogon\n\nWe currently do not know of any identity provider that provides *unverified*\nemail addresses to CILogon, so this is not a severe known vulnerability. However,\nthere are hundreds of IdPs, and we could not try them all.\n\n# Patches\n\nThis patch makes a *breaking change* in how `allowed_idps` is interpreted. It\u0027s\nno longer a list of domains, but configuration representing the `EntityID` of the\nIdPs that are allowed, picked from the [list maintained by CILogon](https://cilogon.org/idplist/).\nSo instead of `berkeley.edu`, you would specify `urn:mace:incommon:berkeley.edu` to\nallow logins from users currently with `berkeley.edu` accounts. GitHub users\nwith a verified `berkeley.edu` email will no longer be allowed to log in.\n\nFor details on how to transition your CILogonOAuthenticator configuration to the patched version 15.0.0 or above, see [the migration](https://oauthenticator.readthedocs.io/en/latest/migrations.html) documentation.",
  "id": "GHSA-r7v4-jwx9-wx43",
  "modified": "2022-06-06T21:21:40Z",
  "published": "2022-06-06T21:21:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-r7v4-jwx9-wx43"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31027"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterhub/oauthenticator/commit/5cd2d1816f90dc5c946e6e38fd2d0ba535624c5c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyterhub/oauthenticator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthenticator/PYSEC-2022-206.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator"
}

GHSA-R7X3-QHQ3-X8HR

Vulnerability from github – Published: 2025-05-09 03:30 – Updated: 2025-05-09 03:30
VLAI
Details

The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password and email through the edit_profile_data() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses and passwords, including administrators, and leverage that to gain access to their account.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-3810"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-09T03:15:24Z",
    "severity": "CRITICAL"
  },
  "details": "The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user\u0027s identity prior to updating their details like password and email through the edit_profile_data() function. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s email addresses and passwords, including administrators, and leverage that to gain access to their account.",
  "id": "GHSA-r7x3-qhq3-x8hr",
  "modified": "2025-05-09T03:30:25Z",
  "published": "2025-05-09T03:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3810"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3278939/wpbookit/trunk/core/admin/classes/controllers/class.wpb-profile-controller.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/54f1ebfb-67f1-461d-91f1-269b0a2c0653?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R7X9-8PH7-W8CG

Vulnerability from github – Published: 2026-02-03 18:42 – Updated: 2026-02-03 18:42
VLAI
Summary
Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing
Details

Summary

An Insecure Direct Object Reference (CWE-639) has been found to exist in createHeaderBasedEmailResolver() function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin checks, allowing an external attacker with control of these headers to route inbound mail to arbitrary Durable Object instances and namespaces.

Root cause

The createHeaderBasedEmailResolver() function lacks cryptographic verification or origin validation for the headers used in the routing logic, effectively allowing external input to dictate internal object routing.

Impact

Insecure Direct Object Reference (IDOR) in email routing lets an attacker steer inbound mail to arbitrary Agent instances via spoofed Message-ID.

Patches

Agents-sdk users should upgrade to agents@0.3.7. PR: https://github.com/cloudflare/agents/pull/811 This documentation provides the necessary architectural context for coding agents to mitigate the issue by refactoring the resolver to enforce strict identity boundaries.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "agents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-1664"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-03T18:42:01Z",
    "nvd_published_at": "2026-02-03T12:16:11Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn Insecure Direct Object Reference (CWE-639) has been found to exist in createHeaderBasedEmailResolver() function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin checks, allowing an external attacker with control of these headers to route inbound mail to arbitrary Durable Object instances and namespaces.\n\n### Root cause\nThe createHeaderBasedEmailResolver() function lacks cryptographic verification or origin validation for the headers used in the routing logic, effectively allowing external input to dictate internal object routing.\n\n### Impact\nInsecure Direct Object Reference (IDOR) in email routing lets an attacker steer inbound mail to arbitrary Agent instances via spoofed Message-ID.\n\n\n\n### Patches\nAgents-sdk users should  upgrade to agents@0.3.7. \nPR: https://github.com/cloudflare/agents/pull/811\nThis [documentation](https://github.com/cloudflare/agents/blob/main/docs/email.md) provides the necessary architectural context for coding agents to mitigate the issue by refactoring the resolver to enforce strict identity boundaries.",
  "id": "GHSA-r7x9-8ph7-w8cg",
  "modified": "2026-02-03T18:42:01Z",
  "published": "2026-02-03T18:42:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cloudflare/agents/security/advisories/GHSA-r7x9-8ph7-w8cg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1664"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cloudflare/agents"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudflare/agents/blob/main/docs/email.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing"
}

GHSA-R827-5P5R-W6F5

Vulnerability from github – Published: 2023-07-06 19:24 – Updated: 2026-05-20 09:30
VLAI
Details

Algan Yazılım Prens Student Information System product has an authenticated Insecure Direct Object Reference (IDOR) vulnerability.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-2808"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-02T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "Algan Yaz\u00c4\u00b1l\u00c4\u00b1m Prens Student Information System product has an authenticated Insecure Direct Object Reference (IDOR) vulnerability.",
  "id": "GHSA-r827-5p5r-w6f5",
  "modified": "2026-05-20T09:30:32Z",
  "published": "2023-07-06T19:24:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2808"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-22-0708"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-22-0708"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R82J-G6Q9-MVX8

Vulnerability from github – Published: 2026-06-11 12:32 – Updated: 2026-06-11 12:32
VLAI
Details

GitLab has remediated an issue in GitLab EE affecting all versions from 15.5 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with group Owner role to take over another group member's GitLab account due to improper authorization in the Group SAML identity management functionality.

Severity
8.7 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-6552"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-11T12:16:32Z",
    "severity": "HIGH"
  },
  "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 15.5 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with group Owner role to take over another group member\u0027s GitLab account due to improper authorization in the Group SAML identity management functionality.",
  "id": "GHSA-r82j-g6q9-mvx8",
  "modified": "2026-06-11T12:32:45Z",
  "published": "2026-06-11T12:32:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6552"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3655189"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/597295"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R8JR-WG88-FQ5C

Vulnerability from github – Published: 2026-03-12 12:30 – Updated: 2026-04-02 15:31
VLAI
Summary
Keycloak vulnerable to authorization bypass via the Admin API
Details

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

Severity
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@keycloak/keycloak-admin-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.keycloak:keycloak-js-admin-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-2366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-12T17:38:28Z",
    "nvd_published_at": "2026-03-12T11:15:55Z",
    "severity": "LOW"
  },
  "details": "A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim\u0027s unique identifier (UUID) and the Organizations feature is enabled.",
  "id": "GHSA-r8jr-wg88-fq5c",
  "modified": "2026-04-02T15:31:35Z",
  "published": "2026-03-12T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2366"
    },
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak/issues/47062"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:6477"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:6478"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2366"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439081"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keycloak/keycloak"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Keycloak vulnerable to authorization bypass via the Admin API"
}

GHSA-R8QG-P9R3-CC3J

Vulnerability from github – Published: 2025-01-07 15:31 – Updated: 2025-01-07 15:31
VLAI
Details

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit resumes for other applicants when applying for jobs.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-12131"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-07T13:15:06Z",
    "severity": "MODERATE"
  },
  "details": "The WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit resumes for other applicants when applying for jobs.",
  "id": "GHSA-r8qg-p9r3-cc3j",
  "modified": "2025-01-07T15:31:47Z",
  "published": "2025-01-07T15:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12131"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.2.6/modules/jobapply/model.php?rev=3216415"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b4772ab0-41cd-4b35-bda9-d72e0fd7b7a5?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R8VM-WP6W-FXFH

Vulnerability from github – Published: 2025-12-17 21:30 – Updated: 2025-12-19 21:30
VLAI
Details

AVideo versions prior to 20.0 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-34438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-17T20:15:54Z",
    "severity": "MODERATE"
  },
  "details": "AVideo versions prior to 20.0 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.",
  "id": "GHSA-r8vm-wp6w-fxfh",
  "modified": "2025-12-19T21:30:17Z",
  "published": "2025-12-17T21:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/4a53ab2056"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/c2feaf25cb"
    },
    {
      "type": "WEB",
      "url": "https://chocapikk.com/posts/2025/avideo-security-vulnerabilities"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/avideo-idor-arbirary-video-rotation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-R9GC-9VW9-725F

Vulnerability from github – Published: 2026-03-30 03:30 – Updated: 2026-03-30 03:30
VLAI
Details

The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-3124"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-30T02:16:15Z",
    "severity": "HIGH"
  },
  "details": "The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.",
  "id": "GHSA-r9gc-9vw9-725f",
  "modified": "2026-03-30T03:30:19Z",
  "published": "2026-03-30T03:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3124"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3470119/download-monitor"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/45527d6c-6866-44e6-85c2-5be984afbbc9?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R9M9-87P7-XJ9F

Vulnerability from github – Published: 2026-06-25 06:30 – Updated: 2026-06-25 06:30
VLAI
Details

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to read or modify another group's virtual registry cleanup policy settings without authorization.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-5309"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T05:16:55Z",
    "severity": "MODERATE"
  },
  "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to read or modify another group\u0027s virtual registry cleanup policy settings without authorization.",
  "id": "GHSA-r9m9-87p7-xj9f",
  "modified": "2026-06-25T06:30:42Z",
  "published": "2026-06-25T06:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5309"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3628793"
    },
    {
      "type": "WEB",
      "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/595468"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list