Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

3222 vulnerabilities reference this CWE, most recent first.

GHSA-W9WH-97QP-XQ2V

Vulnerability from github – Published: 2023-11-21 00:30 – Updated: 2023-11-21 00:30
VLAI
Details

Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by knowing their username.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-6144"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-21T00:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "Dev blog v1.0 allows to exploit an account takeover through the \"user\" cookie. With this, an attacker can access any user\u0027s session just by knowing their username.\n",
  "id": "GHSA-w9wh-97qp-xq2v",
  "modified": "2023-11-21T00:30:27Z",
  "published": "2023-11-21T00:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6144"
    },
    {
      "type": "WEB",
      "url": "https://fluidattacks.com/advisories/almighty"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Armanidrisi/devblog"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WCG8-G6M5-JGH5

Vulnerability from github – Published: 2026-02-14 09:31 – Updated: 2026-02-14 09:31
VLAI
Details

The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.1.6. This is due to the scheduler_widget_ajax_save_event() function lacking proper authorization checks and ownership verification when updating events. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify any event in the scheduler via the id parameter granted they have knowledge of the event ID.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-1987"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-14T07:16:12Z",
    "severity": "MODERATE"
  },
  "details": "The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.1.6. This is due to the `scheduler_widget_ajax_save_event()` function lacking proper authorization checks and ownership verification when updating events. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify any event in the scheduler via the `id` parameter granted they have knowledge of the event ID.",
  "id": "GHSA-wcg8-g6m5-jgh5",
  "modified": "2026-02-14T09:31:34Z",
  "published": "2026-02-14T09:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1987"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/639.html"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/862.html"
    },
    {
      "type": "WEB",
      "url": "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/scheduler-widget/tags/0.1.6/scheduler-widget.php#L158"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/scheduler-widget/trunk/scheduler-widget.php#L158"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fd5f370c-743f-41f1-80ab-7f0805cae38c?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WCH8-MHJ5-9FRG

Vulnerability from github – Published: 2026-06-17 14:11 – Updated: 2026-06-17 14:11
VLAI
Summary
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
Details

summary

POST /api/chat/completions accepts an image_url.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. An authenticated user can therefore set image_url.url to another user's file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. The user then prompts the LLM to describe / OCR the file and reads the content back.

Same class as CVE-2026-44560 (RAG cross-user access) and the multiple has_access_to_file checks added in routers/files.py -- the auth boundary was tightened on the file router but not on this conversion path.

affected code

backend/open_webui/utils/middleware.py:2113-2150 -- convert_url_images_to_base64:

async def convert_url_images_to_base64(form_data):
    messages = form_data.get('messages', [])
    for message in messages:
        content = message.get('content')
        if not isinstance(content, list):
            continue
        new_content = []
        for item in content:
            if not isinstance(item, dict) or item.get('type') != 'image_url':
                new_content.append(item)
                continue
            image_url = item.get('image_url', {}).get('url', '')
            if image_url.startswith('data:image/'):
                new_content.append(item)
                continue
            try:
                base64_data = await get_image_base64_from_url(image_url)  # <-- no `user` passed
                if base64_data:
                    new_content.append({'type': 'image_url',
                                        'image_url': {'url': base64_data}})

called from the main chat completion middleware at middleware.py:2357:

form_data = await convert_url_images_to_base64(form_data)

backend/open_webui/utils/files.py:57-95 -- get_image_base64_from_url:

async def get_image_base64_from_url(url: str) -> Optional[str]:
    try:
        if url.startswith('http'):
            validate_url(url)
            # ... SSRF-safe fetch with allow_redirects=AIOHTTP_CLIENT_ALLOW_REDIRECTS ...
        else:
            file = await Files.get_file_by_id(url)        # <-- NO user_id filter
            if not file:
                return None
            file_path = await asyncio.to_thread(Storage.get_file, file.path)
            file_path = Path(file_path)
            if file_path.is_file():
                with open(file_path, 'rb') as image_file:
                    encoded_string = base64.b64encode(image_file.read()).decode('utf-8')
                    content_type = mimetypes.guess_type(file_path.name)[0] or (file.meta or {}).get('content_type')
                    ...
                    return f'data:{content_type};base64,{encoded_string}'

Files.get_file_by_id in models/files.py:161 does a bare db.get(File, id) -- no ownership filter. there is a separate Files.get_file_by_id_and_user_id at line 172 that does filter on user_id, and the file router uses has_access_to_file(id, 'read', user, db) at routers/files.py:626 etc. neither check exists on this path.

reproduction

  1. As user A, upload any file (image works cleanly, pdf works if a vision-capable model is configured). Note the file id from the upload response, e.g. c7f1d8e3-....
  2. As user B, POST to /api/v1/chat/completions with body:
{
  "model": "<any vision model>",
  "messages": [
    {
      "role": "user",
      "content": [
        {"type": "text", "text": "transcribe everything you can see in this image"},
        {"type": "image_url", "image_url": {"url": "c7f1d8e3-..."}}
      ]
    }
  ]
}

Server reads user A's file from disk, base64-encodes it, and sends to the LLM as user B's image attachment. LLM response contains the file content.

file id discovery

File ids are UUIDs and not enumerable directly, but they leak via:

  • shared chats / channels containing the original upload
  • knowledge base members can see ids of files contributed by others
  • a user who can read a folder index sees the file ids of files inside
  • chat history exports (/api/v1/chats/{id}) include file ids
  • the user themselves can be tricked into pasting / sharing an id (less likely)

impact

Any authenticated user can read any other user's file content (image and any file with an image-guess mimetype path) via this channel. Severity is bounded by what the LLM will accept in image_url -- in practice, image files work cleanly with any vision model; pdf / docx work with multi-modal providers that accept them.

suggested fix

Thread the authenticated user through to get_image_base64_from_url and resolve the file via Files.get_file_by_id_and_user_id(id, user.id) (or has_access_to_file(id, 'read', user, db) if shared-via-knowledge-base access is intended). Same pattern that's already used in routers/files.py:626 and elsewhere.

minimal patch sketch:

--- a/backend/open_webui/utils/files.py
+++ b/backend/open_webui/utils/files.py
@@ -57,7 +57,7 @@
-async def get_image_base64_from_url(url: str) -> Optional[str]:
+async def get_image_base64_from_url(url: str, user=None) -> Optional[str]:
     try:
         if url.startswith('http'):
             ...
         else:
-            file = await Files.get_file_by_id(url)
+            file = (await Files.get_file_by_id_and_user_id(url, user.id)
+                    if user is not None else None)
+            if file is None:
+                # fall back to access-grant check for shared files
+                file = await Files.get_file_by_id(url)
+                if file and not await has_access_to_file(url, 'read', user):
+                    return None

and pipe user through convert_url_images_to_base64(form_data, user) from the middleware caller. happy to send a PR once you confirm the fix shape you want.

variant note

this was found via patch-diffing existing advisories. the same bug class likely exists in any other site that calls Files.get_file_by_id without an adjacent has_access_to_file / get_file_by_id_and_user_id check. quick grep:

git grep -n 'Files\.get_file_by_id(' -- 'backend/open_webui/**'

worth a sweep across utils/ and routers/ for missed sites.

environment

Open-webui main branch as of commit 3660bc0 (2026-05-10). python 3.x backend. confirmed by reading the source; no instance stood up.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.9.5"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54009"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-17T14:11:44Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## summary\n\n`POST /api/chat/completions` accepts an `image_url.url` value that, when it does NOT start with `http://`, `https://`, or `data:image/`, is interpreted as a file id and resolved against the global file table with no ownership check. An authenticated user can therefore set `image_url.url` to another user\u0027s file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. The user then prompts the LLM to describe / OCR the file and reads the content back.\n\nSame class as CVE-2026-44560 (RAG cross-user access) and the multiple `has_access_to_file` checks added in `routers/files.py` -- the auth boundary was tightened on the file router but not on this conversion path.\n\n## affected code\n\n`backend/open_webui/utils/middleware.py:2113-2150` -- `convert_url_images_to_base64`:\n\n```python\nasync def convert_url_images_to_base64(form_data):\n    messages = form_data.get(\u0027messages\u0027, [])\n    for message in messages:\n        content = message.get(\u0027content\u0027)\n        if not isinstance(content, list):\n            continue\n        new_content = []\n        for item in content:\n            if not isinstance(item, dict) or item.get(\u0027type\u0027) != \u0027image_url\u0027:\n                new_content.append(item)\n                continue\n            image_url = item.get(\u0027image_url\u0027, {}).get(\u0027url\u0027, \u0027\u0027)\n            if image_url.startswith(\u0027data:image/\u0027):\n                new_content.append(item)\n                continue\n            try:\n                base64_data = await get_image_base64_from_url(image_url)  # \u003c-- no `user` passed\n                if base64_data:\n                    new_content.append({\u0027type\u0027: \u0027image_url\u0027,\n                                        \u0027image_url\u0027: {\u0027url\u0027: base64_data}})\n```\n\ncalled from the main chat completion middleware at `middleware.py:2357`:\n\n```python\nform_data = await convert_url_images_to_base64(form_data)\n```\n\n`backend/open_webui/utils/files.py:57-95` -- `get_image_base64_from_url`:\n\n```python\nasync def get_image_base64_from_url(url: str) -\u003e Optional[str]:\n    try:\n        if url.startswith(\u0027http\u0027):\n            validate_url(url)\n            # ... SSRF-safe fetch with allow_redirects=AIOHTTP_CLIENT_ALLOW_REDIRECTS ...\n        else:\n            file = await Files.get_file_by_id(url)        # \u003c-- NO user_id filter\n            if not file:\n                return None\n            file_path = await asyncio.to_thread(Storage.get_file, file.path)\n            file_path = Path(file_path)\n            if file_path.is_file():\n                with open(file_path, \u0027rb\u0027) as image_file:\n                    encoded_string = base64.b64encode(image_file.read()).decode(\u0027utf-8\u0027)\n                    content_type = mimetypes.guess_type(file_path.name)[0] or (file.meta or {}).get(\u0027content_type\u0027)\n                    ...\n                    return f\u0027data:{content_type};base64,{encoded_string}\u0027\n```\n\n`Files.get_file_by_id` in `models/files.py:161` does a bare `db.get(File, id)` -- no ownership filter. there is a separate `Files.get_file_by_id_and_user_id` at line 172 that does filter on `user_id`, and the file router uses `has_access_to_file(id, \u0027read\u0027, user, db)` at `routers/files.py:626` etc. neither check exists on this path.\n\n## reproduction\n\n1. As user A, upload any file (image works cleanly, pdf works if a vision-capable model is configured). Note the file id from the upload response, e.g. `c7f1d8e3-...`.\n2. As user B, POST to `/api/v1/chat/completions` with body:\n\n```json\n{\n  \"model\": \"\u003cany vision model\u003e\",\n  \"messages\": [\n    {\n      \"role\": \"user\",\n      \"content\": [\n        {\"type\": \"text\", \"text\": \"transcribe everything you can see in this image\"},\n        {\"type\": \"image_url\", \"image_url\": {\"url\": \"c7f1d8e3-...\"}}\n      ]\n    }\n  ]\n}\n```\n\nServer reads user A\u0027s file from disk, base64-encodes it, and sends to the LLM as user B\u0027s image attachment. LLM response contains the file content.\n\n## file id discovery\n\nFile ids are UUIDs and not enumerable directly, but they leak via:\n\n- shared chats / channels containing the original upload\n- knowledge base members can see ids of files contributed by others\n- a user who can read a folder index sees the file ids of files inside\n- chat history exports (`/api/v1/chats/{id}`) include file ids\n- the user themselves can be tricked into pasting / sharing an id (less likely)\n\n## impact\n\nAny authenticated user can read any other user\u0027s file content (image and any file with an image-guess mimetype path) via this channel. Severity is bounded by what the LLM will accept in `image_url` -- in practice, image files work cleanly with any vision model; pdf / docx work with multi-modal providers that accept them.\n\n## suggested fix\n\nThread the authenticated user through to `get_image_base64_from_url` and resolve the file via `Files.get_file_by_id_and_user_id(id, user.id)` (or `has_access_to_file(id, \u0027read\u0027, user, db)` if shared-via-knowledge-base access is intended). Same pattern that\u0027s already used in `routers/files.py:626` and elsewhere.\n\nminimal patch sketch:\n\n```diff\n--- a/backend/open_webui/utils/files.py\n+++ b/backend/open_webui/utils/files.py\n@@ -57,7 +57,7 @@\n-async def get_image_base64_from_url(url: str) -\u003e Optional[str]:\n+async def get_image_base64_from_url(url: str, user=None) -\u003e Optional[str]:\n     try:\n         if url.startswith(\u0027http\u0027):\n             ...\n         else:\n-            file = await Files.get_file_by_id(url)\n+            file = (await Files.get_file_by_id_and_user_id(url, user.id)\n+                    if user is not None else None)\n+            if file is None:\n+                # fall back to access-grant check for shared files\n+                file = await Files.get_file_by_id(url)\n+                if file and not await has_access_to_file(url, \u0027read\u0027, user):\n+                    return None\n```\n\nand pipe `user` through `convert_url_images_to_base64(form_data, user)` from the middleware caller. happy to send a PR once you confirm the fix shape you want.\n\n## variant note\n\nthis was found via patch-diffing existing advisories. the same bug class likely exists in any other site that calls `Files.get_file_by_id` without an adjacent `has_access_to_file` / `get_file_by_id_and_user_id` check. quick grep:\n\n```\ngit grep -n \u0027Files\\.get_file_by_id(\u0027 -- \u0027backend/open_webui/**\u0027\n```\n\nworth a sweep across utils/ and routers/ for missed sites.\n\n## environment\n\nOpen-webui main branch as of commit `3660bc0` (2026-05-10). python 3.x backend. confirmed by reading the source; no instance stood up.",
  "id": "GHSA-wch8-mhj5-9frg",
  "modified": "2026-06-17T14:11:44Z",
  "published": "2026-06-17T14:11:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wch8-mhj5-9frg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field"
}

GHSA-WCM6-243C-86F3

Vulnerability from github – Published: 2026-02-04 00:30 – Updated: 2026-07-10 15:31
VLAI
Details

EspoCRM 5.8.5 contains an authentication vulnerability that allows attackers to access other user accounts by manipulating authorization headers. Attackers can decode and modify Basic Authorization and Espo-Authorization tokens to gain unauthorized access to administrative user information and privileges.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-37094"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-303",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-03T22:16:25Z",
    "severity": "HIGH"
  },
  "details": "EspoCRM 5.8.5 contains an authentication vulnerability that allows attackers to access other user accounts by manipulating authorization headers. Attackers can decode and modify Basic Authorization and Espo-Authorization tokens to gain unauthorized access to administrative user information and privileges.",
  "id": "GHSA-wcm6-243c-86f3",
  "modified": "2026-07-10T15:31:34Z",
  "published": "2026-02-04T00:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37094"
    },
    {
      "type": "WEB",
      "url": "https://github.com/espocrm/espocrm/commit/b299220dd0c7acdaa1ed8be8ffd79c7985093c7a"
    },
    {
      "type": "WEB",
      "url": "https://www.espocrm.com"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/48376"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/espocrm-privilege-escalation"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/espocrm-two-factor-auth-bypass-via-auth-token-reuse-between-accounts-with-identical-passwords"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-WCQX-PWQH-X4MJ

Vulnerability from github – Published: 2025-12-24 21:30 – Updated: 2025-12-24 21:30
VLAI
Details

SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitive user credentials. Attackers can retrieve authenticated and unauthenticated user password hashes and pins through unprotected endpoints like Get_Permissions_From_DB.php and Ac10_ReadSortCard.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-25129"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-24T20:15:46Z",
    "severity": "HIGH"
  },
  "details": "SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitive user credentials. Attackers can retrieve authenticated and unauthenticated user password hashes and pins through unprotected endpoints like Get_Permissions_From_DB.php and Ac10_ReadSortCard.",
  "id": "GHSA-wcqx-pwqh-x4mj",
  "modified": "2025-12-24T21:30:30Z",
  "published": "2025-12-24T21:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25129"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46832"
    },
    {
      "type": "WEB",
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5517.php"
    },
    {
      "type": "WEB",
      "url": "http://www.socatech.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-WCR9-PV3R-CX85

Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2024-04-04 02:50
VLAI
Details

Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don't have permission.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-5743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-05-07T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don\u0027t have permission.",
  "id": "GHSA-wcr9-pv3r-cx85",
  "modified": "2024-04-04T02:50:43Z",
  "published": "2022-05-24T17:17:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5743"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/research/tra-2020-31"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WCRQ-P45C-535J

Vulnerability from github – Published: 2026-01-22 18:30 – Updated: 2026-01-27 21:31
VLAI
Details

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through <= 1.3.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-22406"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-22T17:16:33Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through \u003c= 1.3.",
  "id": "GHSA-wcrq-p45c-535j",
  "modified": "2026-01-27T21:31:43Z",
  "published": "2026-01-22T18:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22406"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Theme/overton/vulnerability/wordpress-overton-theme-1-3-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WF2P-9P7H-6852

Vulnerability from github – Published: 2026-07-13 12:35 – Updated: 2026-07-13 12:35
VLAI
Details

Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.13.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-57694"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-13T10:16:36Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through \u003c= 3.9.13.",
  "id": "GHSA-wf2p-9p7h-6852",
  "modified": "2026-07-13T12:35:03Z",
  "published": "2026-07-13T12:35:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57694"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-13-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WF9V-5M62-RW7R

Vulnerability from github – Published: 2022-05-03 00:00 – Updated: 2022-05-03 00:00
VLAI
Details

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-23061"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-01T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.",
  "id": "GHSA-wf9v-5m62-rw7r",
  "modified": "2022-05-03T00:00:47Z",
  "published": "2022-05-03T00:00:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23061"
    },
    {
      "type": "WEB",
      "url": "https://github.com/shopizer-ecommerce/shopizer/commit/6b9f1ecd303b3b724d96bd08095c1a751dcc287e"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23061"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WFHG-RX29-5VJF

Vulnerability from github – Published: 2023-03-27 06:30 – Updated: 2023-03-27 06:30
VLAI
Details

WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-24834"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-27T04:15:00Z",
    "severity": "MODERATE"
  },
  "details": "WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL.",
  "id": "GHSA-wfhg-rx29-5vjf",
  "modified": "2023-03-27T06:30:21Z",
  "published": "2023-03-27T06:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24834"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-6954-ed16b-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list