CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3232 vulnerabilities reference this CWE, most recent first.
GHSA-W2GG-FJFH-G555
Vulnerability from github – Published: 2022-05-13 01:19 – Updated: 2022-05-13 01:19In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).
{
"affected": [],
"aliases": [
"CVE-2018-15833"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-26T17:29:00Z",
"severity": "MODERATE"
},
"details": "In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).",
"id": "GHSA-w2gg-fjfh-g555",
"modified": "2022-05-13T01:19:12Z",
"published": "2022-05-13T01:19:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15833"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/326434"
},
{
"type": "WEB",
"url": "https://open.vanillaforums.com/discussion/36559"
},
{
"type": "WEB",
"url": "https://twitter.com/viperbluff/status/1033067882941304832"
},
{
"type": "WEB",
"url": "https://twitter.com/viperbluff/status/1033640333890834433"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W2H2-67GF-FG28
Vulnerability from github – Published: 2022-05-24 16:50 – Updated: 2023-01-24 21:30In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360.
{
"affected": [],
"aliases": [
"CVE-2019-13605"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-16T17:15:00Z",
"severity": "HIGH"
},
"details": "In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360.",
"id": "GHSA-w2h2-67gf-fg28",
"modified": "2023-01-24T21:30:33Z",
"published": "2022-05-24T16:50:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13605"
},
{
"type": "WEB",
"url": "https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13605.md"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/47123"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/153665/CentOS-Control-Web-Panel-0.9.8.836-Authentication-Bypass.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W2M3-H5QG-M4MX
Vulnerability from github – Published: 2025-10-02 15:31 – Updated: 2026-06-06 09:31Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allows Excavation, Authentication Bypass.This issue affects Assist: through 10.02.2025.
{
"affected": [],
"aliases": [
"CVE-2025-0642"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-02T13:15:30Z",
"severity": "MODERATE"
},
"details": "Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allows Excavation, Authentication Bypass.This issue affects Assist: through 10.02.2025.",
"id": "GHSA-w2m3-h5qg-m4mx",
"modified": "2026-06-06T09:31:14Z",
"published": "2025-10-02T15:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0642"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0309"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0309"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W2RM-X498-V7F9
Vulnerability from github – Published: 2024-05-23 12:31 – Updated: 2024-05-23 12:31An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.
{
"affected": [],
"aliases": [
"CVE-2024-5258"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-23T11:15:24Z",
"severity": "MODERATE"
},
"details": "An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.",
"id": "GHSA-w2rm-x498-v7f9",
"modified": "2024-05-23T12:31:02Z",
"published": "2024-05-23T12:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5258"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/443254"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W35P-GJC5-2G6R
Vulnerability from github – Published: 2026-02-18 18:30 – Updated: 2026-02-18 18:30The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_save function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, and booking permissions granted by an Administrator, to modify other users' plugin settings, such as booking calendar display options, which can disrupt the booking calendar functionality for the targeted user.
{
"affected": [],
"aliases": [
"CVE-2026-2230"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-18T17:21:36Z",
"severity": "MODERATE"
},
"details": "The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_save function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, and booking permissions granted by an Administrator, to modify other users\u0027 plugin settings, such as booking calendar display options, which can disrupt the booking calendar functionality for the targeted user.",
"id": "GHSA-w35p-gjc5-2g6r",
"modified": "2026-02-18T18:30:40Z",
"published": "2026-02-18T18:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2230"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/booking/trunk/includes/save-user-meta/save-user-meta.php#L90"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3456856"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60f7df44-22f9-4a9e-a20c-4b8628674079?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W365-QPC6-8W95
Vulnerability from github – Published: 2023-07-11 00:33 – Updated: 2024-04-04 05:54A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further intervention is required.
{
"affected": [],
"aliases": [
"CVE-2023-30960"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-10T22:15:09Z",
"severity": "MODERATE"
},
"details": "A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further intervention is required.\n\n\n\n",
"id": "GHSA-w365-qpc6-8w95",
"modified": "2024-04-04T05:54:17Z",
"published": "2023-07-11T00:33:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30960"
},
{
"type": "WEB",
"url": "https://palantir.safebase.us/?tcuUid=115d9bf4-201f-4cfe-b2fc-219e3a2d945b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W3J8-9P3J-3WJX
Vulnerability from github – Published: 2025-12-17 18:31 – Updated: 2025-12-18 15:39An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
The project was archived as of December 1, 2023.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pagekit/pagekit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-67165"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-18T15:39:04Z",
"nvd_published_at": "2025-12-17T17:15:51Z",
"severity": "CRITICAL"
},
"details": "An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.\n\nThe project was archived as of December 1, 2023.",
"id": "GHSA-w3j8-9p3j-3wjx",
"modified": "2025-12-18T15:39:04Z",
"published": "2025-12-17T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67165"
},
{
"type": "WEB",
"url": "https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67165"
},
{
"type": "WEB",
"url": "https://github.com/pagekit/docs/blob/develop/user-interface/users.md#permissions"
},
{
"type": "WEB",
"url": "https://github.com/pagekit/docs/blob/develop/user-interface/users.md#roles"
},
{
"type": "PACKAGE",
"url": "https://github.com/pagekit/pagekit"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component"
}
GHSA-W494-P3QW-3WW3
Vulnerability from github – Published: 2025-02-14 09:31 – Updated: 2025-02-15 18:30StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.
{
"affected": [],
"aliases": [
"CVE-2025-26788"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-14T08:15:31Z",
"severity": "HIGH"
},
"details": "StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.",
"id": "GHSA-w494-p3qw-3ww3",
"modified": "2025-02-15T18:30:25Z",
"published": "2025-02-14T09:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26788"
},
{
"type": "WEB",
"url": "https://docs.strongkey.com/index.php/skfs-v3/skfs-release-notes"
},
{
"type": "WEB",
"url": "https://www.securing.pl/en/cve-2025-26788-passkey-authentication-bypass-in-strongkey-fido-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-W4C2-J77V-WMG3
Vulnerability from github – Published: 2024-11-13 00:30 – Updated: 2024-11-18 21:30SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dashboard and perform actions like modify user, delete user, etc.
{
"affected": [],
"aliases": [
"CVE-2021-27700"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T23:15:03Z",
"severity": "HIGH"
},
"details": "SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dashboard and perform actions like modify user, delete user, etc.",
"id": "GHSA-w4c2-j77v-wmg3",
"modified": "2024-11-18T21:30:44Z",
"published": "2024-11-13T00:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27700"
},
{
"type": "WEB",
"url": "https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2021-27700"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-W4FH-P39J-749C
Vulnerability from github – Published: 2022-08-29 20:06 – Updated: 2022-09-02 00:01The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it would take a long time to find a valid one).
{
"affected": [],
"aliases": [
"CVE-2022-3019"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-29T06:15:00Z",
"severity": "HIGH"
},
"details": "The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id\u0027s might also be an option but I wouldn\u0027t count on it, since it would take a long time to find a valid one).",
"id": "GHSA-w4fh-p39j-749c",
"modified": "2022-09-02T00:01:03Z",
"published": "2022-08-29T20:06:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3019"
},
{
"type": "WEB",
"url": "https://github.com/tooljet/tooljet/commit/45e0d3302d92df7d7f2d609c31cea71165600b79"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a610300b-ce3c-4995-8337-11942b3621bf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.