Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4199 vulnerabilities reference this CWE, most recent first.
GHSA-HP88-WCMX-23JQ
Vulnerability from github – Published: 2022-01-04 00:00 – Updated: 2022-05-12 00:00
VLAI
Details
TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2021-45428"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-03T14:15:00Z",
"severity": "CRITICAL"
},
"details": "TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.",
"id": "GHSA-hp88-wcmx-23jq",
"modified": "2022-05-12T00:00:25Z",
"published": "2022-01-04T00:00:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45428"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1wM1SPOfB9mH2SES7cAmlysuI9fOpFB3F/view?usp=sharing"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HP9P-WJ8M-C339
Vulnerability from github – Published: 2026-07-16 18:31 – Updated: 2026-07-16 18:31
VLAI
Details
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-15945"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-16T18:16:42Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the group search functionality of the Keycloak server\u0027s administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration.",
"id": "GHSA-hp9p-wj8m-c339",
"modified": "2026-07-16T18:31:34Z",
"published": "2026-07-16T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15945"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-15945"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501302"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPGR-7W89-8XM5
Vulnerability from github – Published: 2022-09-07 00:01 – Updated: 2024-03-21 03:34
VLAI
Details
Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to change a user's contact details.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-32277"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-06T20:15:00Z",
"severity": "MODERATE"
},
"details": "Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to change a user\u0027s contact details.",
"id": "GHSA-hpgr-7w89-8xm5",
"modified": "2024-03-21T03:34:18Z",
"published": "2022-09-07T00:01:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32277"
},
{
"type": "WEB",
"url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog"
},
{
"type": "WEB",
"url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/squiz-matrix-cms-authenticated-privilege-escalation-through-idor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPHP-FMHR-5FQH
Vulnerability from github – Published: 2026-07-06 21:30 – Updated: 2026-07-06 21:30
VLAI
Details
Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-59712"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-06T21:16:58Z",
"severity": "HIGH"
},
"details": "Leantime\u0027s Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.",
"id": "GHSA-hphp-fmhr-5fqh",
"modified": "2026-07-06T21:30:43Z",
"published": "2026-07-06T21:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59712"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime/issues/3556"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime/commit/4f2612d13e0e8a2093092a846b44506cf133b671"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/leantime-credential-disclosure-via-unauthenticated-json-rpc-users-getuser-method"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HPR7-FPW7-JCX2
Vulnerability from github – Published: 2023-08-18 15:30 – Updated: 2024-10-07 21:33
VLAI
Details
An issue was discovered in phpList 3.6.12. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one to perform an account takeover of the user with super-admin permission.
Severity
6.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-27576"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-18T15:15:09Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in phpList 3.6.12. Due to an access error, it was possible to manipulate and edit data of the system\u0027s super admin, allowing one to perform an account takeover of the user with super-admin permission.",
"id": "GHSA-hpr7-fpw7-jcx2",
"modified": "2024-10-07T21:33:27Z",
"published": "2023-08-18T15:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27576"
},
{
"type": "WEB",
"url": "https://github.com/phpList/phplist3/pull/986"
},
{
"type": "WEB",
"url": "https://cupc4k3.lol/cve-2023-27576-hacking-phplist-how-i-gained-super-admin-access-44c7c90d82da"
},
{
"type": "WEB",
"url": "https://www.phplist.org/newslist/phplist-3-6-14-release-notes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HPXP-RX7C-457J
Vulnerability from github – Published: 2026-04-09 00:32 – Updated: 2026-08-27 21:31
VLAI
Details
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-4398"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T23:16:59Z",
"severity": "MODERATE"
},
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
"id": "GHSA-hpxp-rx7c-457j",
"modified": "2026-08-27T21:31:13Z",
"published": "2026-04-09T00:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4398"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3549150"
},
{
"type": "WEB",
"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/600360"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPXV-VPFV-7JC9
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-02-12 11:46
VLAI
Summary
Magento 2 Community Edition IDOR Vulnerability
Details
An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-7854"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-17T21:02:25Z",
"nvd_published_at": "2019-08-02T22:15:00Z",
"severity": "HIGH"
},
"details": "An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.",
"id": "GHSA-hpxv-vpfv-7jc9",
"modified": "2024-02-12T11:46:52Z",
"published": "2022-05-24T16:52:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7854"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7854.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/magento/magento2"
},
{
"type": "WEB",
"url": "https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Magento 2 Community Edition IDOR Vulnerability"
}
GHSA-HQ4H-W933-JM6C
Vulnerability from github – Published: 2024-12-30 16:12 – Updated: 2024-12-30 18:43
VLAI
Summary
khoj has an IDOR in subscription management allows unauthorized subscription modifications
Details
Summary
An Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request.
Details
The vulnerability exists in the subscription endpoint at /api/subscription. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription.
Vulnerable code in /api/subscription:
@subscription_router.patch("")
@requires(["authenticated"])
async def update_subscription(request: Request, email: str, operation: str):
# IDOR: email parameter directly references user subscriptions without ownership verification
customers = stripe.Customer.list(email=email).auto_paging_iter()
customer = next(customers, None)
if operation == "cancel":
# Any authenticated user can modify any subscription referenced by email
customer_id = customer.id
for subscription in stripe.Subscription.list(customer=customer_id):
stripe.Subscription.modify(subscription.id, cancel_at_period_end=True)
PoC
- Create a customer account in stripe:
-
Customer A:
adventure8812@zeropath.com(attacker) -
Log in as any user.
-
Send this request:
PATCH /api/subscription?email=adventure8812@zeropath.com&operation=cancel HTTP/1.1
- The subscription for Customer A is successfully set to cancel.
Impact
High: Revenue loss via mass cancellation of subscriptions. Loss of customer trust by re-enabling subscriptions they had set to cancel.
Resolution
This was fixed in the following commit which limited subscription update operations to the authenticated user: https://github.com/khoj-ai/khoj/commit/47d3c8c23597900af708bdc60aced3ae5d2064c1. Support for arbitrarily presenting an email for update has been deprecated.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "khoj"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.29.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-52294"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-30T16:12:40Z",
"nvd_published_at": "2024-12-30T17:15:09Z",
"severity": "MODERATE"
},
"details": "### Summary\nAn Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users\u0027 Stripe subscriptions by simply modifying the email parameter in the request.\n\n### Details\nThe vulnerability exists in the subscription endpoint at `/api/subscription`. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription.\n\nVulnerable code in `/api/subscription`:\n```python\n@subscription_router.patch(\"\")\n@requires([\"authenticated\"])\nasync def update_subscription(request: Request, email: str, operation: str):\n # IDOR: email parameter directly references user subscriptions without ownership verification\n customers = stripe.Customer.list(email=email).auto_paging_iter()\n customer = next(customers, None)\n \n if operation == \"cancel\":\n # Any authenticated user can modify any subscription referenced by email\n customer_id = customer.id\n for subscription in stripe.Subscription.list(customer=customer_id):\n stripe.Subscription.modify(subscription.id, cancel_at_period_end=True)\n```\n\n### PoC\n1. Create a customer account in stripe:\n - Customer A: `adventure8812@zeropath.com` (attacker)\n\n2. Log in as any user.\n\n3. Send this request:\n```http\nPATCH /api/subscription?email=adventure8812@zeropath.com\u0026operation=cancel HTTP/1.1\n```\n\n4. The subscription for Customer A is successfully set to cancel.\n\n### Impact\nHigh:\nRevenue loss via mass cancellation of subscriptions.\nLoss of customer trust by re-enabling subscriptions they had set to cancel.\n\n### Resolution\n\nThis was fixed in the following commit which limited subscription update operations to the authenticated user: https://github.com/khoj-ai/khoj/commit/47d3c8c23597900af708bdc60aced3ae5d2064c1. Support for arbitrarily presenting an email for update has been deprecated.\n",
"id": "GHSA-hq4h-w933-jm6c",
"modified": "2024-12-30T18:43:16Z",
"published": "2024-12-30T16:12:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/khoj-ai/khoj/security/advisories/GHSA-hq4h-w933-jm6c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52294"
},
{
"type": "WEB",
"url": "https://github.com/khoj-ai/khoj/commit/47d3c8c23597900af708bdc60aced3ae5d2064c1"
},
{
"type": "PACKAGE",
"url": "https://github.com/khoj-ai/khoj"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "khoj has an IDOR in subscription management allows unauthorized subscription modifications"
}
GHSA-HQFM-F44V-GMX6
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10
VLAI
Details
The bulletin function of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bulletin particular content.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-37212"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-706"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-09T10:15:00Z",
"severity": "MODERATE"
},
"details": "The bulletin function of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the bulletin ID in specific Url parameters and access and modify bulletin particular content.",
"id": "GHSA-hqfm-f44v-gmx6",
"modified": "2022-05-24T19:10:28Z",
"published": "2022-05-24T19:10:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37212"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-4989-5d955-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HQG2-5GXQ-FJHC
Vulnerability from github – Published: 2025-08-21 15:30 – Updated: 2025-08-21 15:30
VLAI
Details
Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-55370"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-21T14:15:41Z",
"severity": "HIGH"
},
"details": "Incorrect access control in the component \\controller\\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.",
"id": "GHSA-hqg2-5gxq-fjhc",
"modified": "2025-08-21T15:30:35Z",
"published": "2025-08-21T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55370"
},
{
"type": "WEB",
"url": "https://github.com/cina666/CVE/blob/main/jshERP/%E8%B6%8A%E6%9D%83%E8%8E%B7%E5%8F%96%E4%BB%BB%E6%84%8F%E8%B4%A6%E5%8F%B7%E4%BF%A1%E6%81%AF%E5%AE%9E%E7%8E%B0%E4%BB%BB%E6%84%8F%E7%99%BB%E5%BD%95.md"
},
{
"type": "WEB",
"url": "https://github.com/jishenghua/jshERP"
},
{
"type": "WEB",
"url": "http://jsherp.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.