CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3214 vulnerabilities reference this CWE, most recent first.
GHSA-XXCG-MCHR-FPH7
Vulnerability from github – Published: 2025-09-16 15:32 – Updated: 2026-06-05 15:32Authorization Bypass Through User-Controlled Key vulnerability with user privileges in ArgusTech BILGER allows Exploitation of Trusted Identifiers.This issue affects BILGER: before 2.4.6.
{
"affected": [],
"aliases": [
"CVE-2025-5518"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-16T08:15:43Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability with user privileges in ArgusTech BILGER allows Exploitation of Trusted Identifiers.This issue affects BILGER: before 2.4.6.",
"id": "GHSA-xxcg-mchr-fph7",
"modified": "2026-06-05T15:32:04Z",
"published": "2025-09-16T15:32:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5518"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0250"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0250"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXCH-MF4J-QCVJ
Vulnerability from github – Published: 2023-03-24 06:30 – Updated: 2025-02-20 00:32Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.
{
"affected": [],
"aliases": [
"CVE-2023-28686"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T04:15:00Z",
"severity": "HIGH"
},
"details": "Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.",
"id": "GHSA-xxch-mf4j-qcvj",
"modified": "2025-02-20T00:32:02Z",
"published": "2023-03-24T06:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28686"
},
{
"type": "WEB",
"url": "https://dino.im/security/cve-2023-28686"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQLCEUZS5GPHUQMS7C6W2NS3PHYUFHYF"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GOH6NYTLPM52MDIR2IRVUR3REDVWZV6N"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IIWXAK656EHSRIRUHLPBE3AX2I4TMH7M"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQLCEUZS5GPHUQMS7C6W2NS3PHYUFHYF"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GOH6NYTLPM52MDIR2IRVUR3REDVWZV6N"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIWXAK656EHSRIRUHLPBE3AX2I4TMH7M"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5379"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXPJ-Q764-9R6Q
Vulnerability from github – Published: 2026-06-05 16:22 – Updated: 2026-06-05 16:22Summary
A low-privilege MCP token holder with knowledge of an attachment path could read any
file in shared storage, including attachments belonging to other bases and workspaces,
because the MCP readAttachment tool did not verify the file's ownership.
Details
The MCP readAttachment tool accepts caller-supplied path/url values and streams
the file via the storage adapter. The handler now looks up the path in
nc_file_references and requires a non-deleted row whose base_id matches the
caller's MCP context before streaming; otherwise it returns
Attachment is not accessible from this MCP context. The lookup tolerates both
download/uploads/... and uploads/... styles.
Impact
Arbitrary read against shared storage scoped to attachments the caller's MCP context should not see. Exploitation requires an MCP token and a known attachment path.
Credit
This issue was reported by @helwor-01.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.05.0"
},
"package": {
"ecosystem": "npm",
"name": "nocodb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.05.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47388"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-05T16:22:28Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\nA low-privilege MCP token holder with knowledge of an attachment path could read any\nfile in shared storage, including attachments belonging to other bases and workspaces,\nbecause the MCP `readAttachment` tool did not verify the file\u0027s ownership.\n\n### Details\nThe MCP `readAttachment` tool accepts caller-supplied `path`/`url` values and streams\nthe file via the storage adapter. The handler now looks up the path in\n`nc_file_references` and requires a non-deleted row whose `base_id` matches the\ncaller\u0027s MCP context before streaming; otherwise it returns\n`Attachment is not accessible from this MCP context`. The lookup tolerates both\n`download/uploads/...` and `uploads/...` styles.\n\n### Impact\nArbitrary read against shared storage scoped to attachments the caller\u0027s MCP context\nshould not see. Exploitation requires an MCP token and a known attachment path.\n\n### Credit\nThis issue was reported by [@helwor-01](https://github.com/helwor-01).",
"id": "GHSA-xxpj-q764-9r6q",
"modified": "2026-06-05T16:22:29Z",
"published": "2026-06-05T16:22:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nocodb/nocodb/security/advisories/GHSA-xxpj-q764-9r6q"
},
{
"type": "PACKAGE",
"url": "https://github.com/nocodb/nocodb"
},
{
"type": "WEB",
"url": "https://github.com/nocodb/nocodb/releases/tag/2026.05.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "NocoDB: Missing Ownership Check in MCP Attachment Read"
}
GHSA-XXWR-WV9G-7JW3
Vulnerability from github – Published: 2025-05-21 17:19 – Updated: 2025-05-21 19:05Insecure Direct Object Reference (IDOR) in the femanager TYPO3 extension allows attackers to view frontend user data via a user parameter in the newAction of the newController.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "in2code/femanager"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.2.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "in2code/femanager"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.4.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "in2code/femanager"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.4.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "in2code/femanager"
},
"ranges": [
{
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.5.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-48202"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-425",
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-21T17:19:30Z",
"nvd_published_at": "2025-05-21T16:15:32Z",
"severity": "MODERATE"
},
"details": "Insecure Direct Object Reference (IDOR) in the femanager TYPO3 extension allows attackers to view frontend user data via a user parameter in the newAction of the newController.",
"id": "GHSA-xxwr-wv9g-7jw3",
"modified": "2025-05-21T19:05:14Z",
"published": "2025-05-21T17:19:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48202"
},
{
"type": "WEB",
"url": "https://github.com/in2code-de/femanager/commit/54851f8f60254bd8060bdf7bc16d56f4de7bd828"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2025-48202.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/in2code-de/femanager"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2025-006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C",
"type": "CVSS_V3"
}
],
"summary": "The femanager TYPO3 extension allows Insecure Direct Object Reference"
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.