Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4076 vulnerabilities reference this CWE, most recent first.
GHSA-H2VX-J6J7-FWRX
Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2023-01-24 21:30
VLAI
Details
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victim's account via an attacker account.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2019-14724"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-11T12:15:00Z",
"severity": "HIGH"
},
"details": "In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victim\u0027s account via an attacker account.",
"id": "GHSA-h2vx-j6j7-fwrx",
"modified": "2023-01-24T21:30:33Z",
"published": "2022-05-24T16:55:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14724"
},
{
"type": "WEB",
"url": "https://centos-webpanel.com/changelog-cwp7"
},
{
"type": "WEB",
"url": "https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-14724.md"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/154404/Control-Web-Panel-0.9.8.851-Privilege-Escalation.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H357-7CF2-9RWF
Vulnerability from github – Published: 2023-02-03 15:31 – Updated: 2023-02-10 03:30
VLAI
Details
Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-34138"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-03T15:15:00Z",
"severity": "HIGH"
},
"details": "Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information.",
"id": "GHSA-h357-7cf2-9rwf",
"modified": "2023-02-10T03:30:19Z",
"published": "2023-02-03T15:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34138"
},
{
"type": "WEB",
"url": "https://docs.biltema.com/v2/documents/file/nb/6a9ff001-a0e0-48c4-a802-83e8b5a5e213"
},
{
"type": "WEB",
"url": "https://kth.diva-portal.org/smash/get/diva2:1729289/FULLTEXT01.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H36X-J947-47G9
Vulnerability from github – Published: 2024-10-05 15:30 – Updated: 2026-04-01 18:31
VLAI
Details
Authorization Bypass Through User-Controlled Key vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.9.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-47316"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-05T13:15:13Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.9.",
"id": "GHSA-h36x-j947-47g9",
"modified": "2026-04-01T18:31:55Z",
"published": "2024-10-05T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47316"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/salon-booking-system/vulnerability/wordpress-salon-booking-wordpress-plugin-plugin-10-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/salon-booking-system/wordpress-salon-booking-wordpress-plugin-plugin-10-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H376-X6H9-H5F3
Vulnerability from github – Published: 2026-01-28 09:30 – Updated: 2026-04-08 18:34
VLAI
Details
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the 'bplde_save_document_library', 'bplde_get_single', and 'bplde_delete_document_library' AJAX actions. This makes it possible for authenticated attackers, with Author-level access and above, to read, modify, and delete Document Library entries created by other users, including administrators, via the 'id' parameter.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-1389"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-28T08:16:03Z",
"severity": "MODERATE"
},
"details": "The Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the \u0027bplde_save_document_library\u0027, \u0027bplde_get_single\u0027, and \u0027bplde_delete_document_library\u0027 AJAX actions. This makes it possible for authenticated attackers, with Author-level access and above, to read, modify, and delete Document Library entries created by other users, including administrators, via the \u0027id\u0027 parameter.",
"id": "GHSA-h376-x6h9-h5f3",
"modified": "2026-04-08T18:34:02Z",
"published": "2026-01-28T09:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1389"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/document-emberdder/tags/2.0.3/includes/DocumentLibrary/Init-DocumentLibrary.php#L103"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/document-emberdder/tags/2.0.3/includes/DocumentLibrary/Init-DocumentLibrary.php#L159"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/document-emberdder/tags/2.0.3/includes/DocumentLibrary/Init-DocumentLibrary.php#L66"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/document-emberdder/tags/2.0.5/includes/DocumentLibrary/Init-DocumentLibrary.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59d14f6c-6286-454c-8629-96a0c2de943c?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H37X-RM9W-8GPX
Vulnerability from github – Published: 2026-01-12 06:30 – Updated: 2026-01-14 18:31
VLAI
Details
Authorization Bypass Through User-Controlled Key vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Privilege Escalation.This issue affects DX NetOps Spectrum: 24.3.10 and earlier.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-69274"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-12T05:16:11Z",
"severity": "LOW"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Privilege Escalation.This issue affects DX NetOps Spectrum: 24.3.10 and earlier.",
"id": "GHSA-h37x-rm9w-8gpx",
"modified": "2026-01-14T18:31:18Z",
"published": "2026-01-12T06:30:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69274"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36756"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-H388-6737-2GRV
Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2022-05-24 22:28
VLAI
Details
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades
{
"affected": [],
"aliases": [
"CVE-2021-24562"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-23T12:15:00Z",
"severity": "HIGH"
},
"details": "The LMS by LifterLMS \u00e2\u20ac\u201c Online Course, Membership \u0026 Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades",
"id": "GHSA-h388-6737-2grv",
"modified": "2022-05-24T22:28:41Z",
"published": "2022-05-24T22:28:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24562"
},
{
"type": "WEB",
"url": "https://make.lifterlms.com/2021/05/17/lifterlms-version-4-21-2"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/d45bb744-4a0d-4af0-aa16-71f7e3ea6e00"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-H38R-5M65-J9VP
Vulnerability from github – Published: 2024-07-09 12:30 – Updated: 2024-07-09 12:30
VLAI
Details
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.
Severity
5.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-3290"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-09T11:15:12Z",
"severity": "MODERATE"
},
"details": "A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.",
"id": "GHSA-h38r-5m65-j9vp",
"modified": "2024-07-09T12:30:56Z",
"published": "2024-07-09T12:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3290"
},
{
"type": "WEB",
"url": "https://github.com/alextselegidis/easyappointments"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H3M5-97JQ-QJRF
Vulnerability from github – Published: 2026-06-19 21:43 – Updated: 2026-07-02 20:12
VLAI
Summary
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
Details
Summary
OpenRemote Manager is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) in the bulk alarm deletion endpoint. An authenticated user in any realm can delete alarms belonging to other realms (tenants) by supplying arbitrary alarm IDs. The vulnerability exists because the bulk removeAlarms() method only verifies that the caller's own realm is active and accessible, but never checks whether the targeted alarm IDs belong to the caller's realm before deleting them.
This allows any user with alarm write permissions in their own realm to permanently destroy alarm records — including safety-critical and security alerts — belonging to any other tenant on the same OpenRemote installation.
[Additional Information] The singular removeAlarm() method correctly validates that the target alarm's realm matches the caller's access:
// CORRECT (singular):
SentAlarm alarm = alarmService.getAlarm(alarmId);
if (!isRealmActiveAndAccessible(alarm.getRealm())) {
throw new ForbiddenException(...);
}
The plural removeAlarms() method is missing this per-alarm realm check and only validates the caller's own realm — a check that is trivially satisfied for any authenticated user:
// VULNERABLE (plural):
public void removeAlarms(RequestParams requestParams, List<Long> alarmIds) {
if (!isRealmActiveAndAccessible(getAuthenticatedRealmName())) {
throw new ForbiddenException(...); // always passes for any auth user
}
List<SentAlarm> alarms = alarmService.getAlarms(alarmIds); // no realm filter
alarmService.removeAlarms(alarms, alarmIds); // no realm filter
}
The underlying service queries contain no realm scoping:
``` // AlarmService.getAlarms(List): "select sa from SentAlarm sa where sa.id in :ids" // no realm filter
// AlarmService.removeAlarms():
"delete from SentAlarm sa where sa.id in :ids"
// no realm filter
Alarm IDs are sequential auto-increment Long values (JPA
@GeneratedValue), making them trivially enumerable.
[Vulnerability Type]
Insecure Direct Object Reference (IDOR) / Missing Authorization
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862: Missing Authorization
------------------------------------------
[Vendor of Product]
OpenRemote Inc. (openremote.io)
------------------------------------------
[Affected Product Code Base]
OpenRemote Manager - current version as of 2026
(github.com/openremote/openremote)
------------------------------------------
[Affected Component]
org.openremote.manager.alarm.AlarmResourceImpl#removeAlarms()
org.openremote.manager.alarm.AlarmService#getAlarms(List<Long>)
org.openremote.manager.alarm.AlarmService#removeAlarms()
File: manager/src/main/java/org/openremote/manager/alarm/AlarmResourceImpl.java
File: manager/src/main/java/org/openremote/manager/alarm/AlarmService.java
------------------------------------------
[Attack Type]
Remote (authenticated)
------------------------------------------
[CVE Impact Other]
Cross-tenant permanent destruction of alarm records, including
safety-critical and security alerts in IoT environments. Also enables
cross-tenant alarm enumeration (presence disclosure of alarm IDs
across all tenants).
------------------------------------------
[Attack Vectors]
1. Attacker registers or obtains any low-privilege account in any realm
on the target OpenRemote installation (or uses an existing account).
2. Attacker enumerates alarm IDs belonging to other realms by sending
bulk delete requests with sequential IDs (presence confirmed by
404 vs 200 response codes).
3. Attacker issues a single bulk delete request containing IDs of
alarms belonging to victim realm(s).
4. Alarms are permanently deleted with no authorization error.
PoC:
Tenant A (attacker) : realm = "tenant-a" user = attacker@tenant-a.com role = WRITE_ALARMS_ROLE
Tenant B (victim) : realm = "tenant-b" alarms with IDs 1174,1173, 1180 exist
DELETE /api/smartcity/alarm HTTP/2 Content-Type: application/json
[1174,1173, 1180] /// <- alarm ID ```
Severity
9.6 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.openremote:openremote-manager"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-57168"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T21:43:17Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary\nOpenRemote Manager is vulnerable to a cross-tenant Insecure Direct\nObject Reference (IDOR) in the bulk alarm deletion endpoint. An\nauthenticated user in any realm can delete alarms belonging to other\nrealms (tenants) by supplying arbitrary alarm IDs. The vulnerability\nexists because the bulk removeAlarms() method only verifies that the\ncaller\u0027s own realm is active and accessible, but never checks whether\nthe targeted alarm IDs belong to the caller\u0027s realm before deleting\nthem.\n\nThis allows any user with alarm write permissions in their own realm\nto permanently destroy alarm records \u2014 including safety-critical and\nsecurity alerts \u2014 belonging to any other tenant on the same OpenRemote\ninstallation.\n\n------------------------------------------\n\n[Additional Information]\nThe singular removeAlarm() method correctly validates that the\ntarget alarm\u0027s realm matches the caller\u0027s access:\n\n // CORRECT (singular):\n SentAlarm alarm = alarmService.getAlarm(alarmId);\n if (!isRealmActiveAndAccessible(alarm.getRealm())) {\n throw new ForbiddenException(...);\n }\n\nThe plural removeAlarms() method is missing this per-alarm realm\ncheck and only validates the caller\u0027s own realm \u2014 a check that is\ntrivially satisfied for any authenticated user:\n\n```\n // VULNERABLE (plural):\npublic void removeAlarms(RequestParams requestParams, List\u003cLong\u003e alarmIds) {\n if (!isRealmActiveAndAccessible(getAuthenticatedRealmName())) { \n throw new ForbiddenException(...); // always passes for any auth user\n }\n List\u003cSentAlarm\u003e alarms = alarmService.getAlarms(alarmIds); // no realm filter\n alarmService.removeAlarms(alarms, alarmIds); // no realm filter\n}\n\n```\nThe underlying service queries contain no realm scoping:\n\n ```\n // AlarmService.getAlarms(List\u003cLong\u003e):\n \"select sa from SentAlarm sa where sa.id in :ids\"\n // no realm filter\n\n // AlarmService.removeAlarms():\n \"delete from SentAlarm sa where sa.id in :ids\"\n // no realm filter\n\n```\nAlarm IDs are sequential auto-increment Long values (JPA\n@GeneratedValue), making them trivially enumerable.\n\n[Vulnerability Type]\nInsecure Direct Object Reference (IDOR) / Missing Authorization\nCWE-639: Authorization Bypass Through User-Controlled Key\nCWE-862: Missing Authorization\n\n------------------------------------------\n\n[Vendor of Product]\nOpenRemote Inc. (openremote.io)\n\n------------------------------------------\n\n[Affected Product Code Base]\nOpenRemote Manager - current version as of 2026\n(github.com/openremote/openremote)\n\n------------------------------------------\n\n[Affected Component]\norg.openremote.manager.alarm.AlarmResourceImpl#removeAlarms()\norg.openremote.manager.alarm.AlarmService#getAlarms(List\u003cLong\u003e)\norg.openremote.manager.alarm.AlarmService#removeAlarms()\n\nFile: manager/src/main/java/org/openremote/manager/alarm/AlarmResourceImpl.java\nFile: manager/src/main/java/org/openremote/manager/alarm/AlarmService.java\n\n------------------------------------------\n\n[Attack Type]\nRemote (authenticated)\n\n------------------------------------------\n\n[CVE Impact Other]\nCross-tenant permanent destruction of alarm records, including\nsafety-critical and security alerts in IoT environments. Also enables\ncross-tenant alarm enumeration (presence disclosure of alarm IDs\nacross all tenants).\n\n------------------------------------------\n\n[Attack Vectors]\n1. Attacker registers or obtains any low-privilege account in any realm\n on the target OpenRemote installation (or uses an existing account).\n2. Attacker enumerates alarm IDs belonging to other realms by sending\n bulk delete requests with sequential IDs (presence confirmed by\n 404 vs 200 response codes).\n3. Attacker issues a single bulk delete request containing IDs of\n alarms belonging to victim realm(s).\n4. Alarms are permanently deleted with no authorization error.\n\nPoC:\n\n```\nTenant A (attacker) : realm = \"tenant-a\"\n user = attacker@tenant-a.com\n role = WRITE_ALARMS_ROLE\n\nTenant B (victim) : realm = \"tenant-b\"\n alarms with IDs 1174,1173, 1180 exist\n```\n\n\n\n```\nDELETE /api/smartcity/alarm HTTP/2\nContent-Type: application/json\n\n\n[1174,1173, 1180] /// \u003c- alarm ID \n```\n\n\u003cimg width=\"1280\" height=\"404\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ffbebea2-2248-42a0-bb22-7a0dc51c78ce\" /\u003e",
"id": "GHSA-h3m5-97jq-qjrf",
"modified": "2026-07-02T20:12:17Z",
"published": "2026-06-19T21:43:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf"
},
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/commit/9fad55e5a448c82772d241d395826e5d6fe1ce2d"
},
{
"type": "PACKAGE",
"url": "https://github.com/openremote/openremote"
},
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/blob/master/manager/src/main/java/org/openremote/manager/alarm/AlarmResourceImpl.java"
},
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/blob/master/manager/src/main/java/org/openremote/manager/alarm/AlarmService.java"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)"
}
GHSA-H3P7-VXPM-G349
Vulnerability from github – Published: 2024-06-14 18:31 – Updated: 2024-11-19 00:32
VLAI
Details
An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. This vulnerability can allow attackers to access the router via a brute-force attack.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-33373"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-14T16:15:11Z",
"severity": "MODERATE"
},
"details": "An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. This vulnerability can allow attackers to access the router via a brute-force attack.",
"id": "GHSA-h3p7-vxpm-g349",
"modified": "2024-11-19T00:32:42Z",
"published": "2024-06-14T18:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33373"
},
{
"type": "WEB",
"url": "https://github.com/ShravanSinghRathore/Security-Advisory-Multiple-Vulnerabilities-in-LB-link-BL-W1210M-Router/wiki/Password-Policy-Bypass--%7C--Inconsistent-Password-Policy-%28CVE%E2%80%902024%E2%80%9033373%29"
},
{
"type": "WEB",
"url": "https://redfoxsec.com/blog/security-advisory-multiple-vulnerabilities-in-lb-link-bl-w1210m-router"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-H3PC-28CX-RR37
Vulnerability from github – Published: 2026-09-04 12:31 – Updated: 2026-09-04 12:31
VLAI
Details
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-85594"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T12:17:22Z",
"severity": "HIGH"
},
"details": "Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.",
"id": "GHSA-h3pc-28cx-rr37",
"modified": "2026-09-04T12:31:00Z",
"published": "2026-09-04T12:31:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-m6wx-622r-48r9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85594"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/traefik-3.7.1-crossprovidernamespaces-bypass-via-service-middleware"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.