CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4264 vulnerabilities reference this CWE, most recent first.
GHSA-J8WJ-77MV-262G
Vulnerability from github – Published: 2022-12-15 21:30 – Updated: 2022-12-20 18:30RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented.
{
"affected": [],
"aliases": [
"CVE-2021-4226"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-15T19:15:00Z",
"severity": "CRITICAL"
},
"details": "RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented.",
"id": "GHSA-j8wj-77mv-262g",
"modified": "2022-12-20T18:30:20Z",
"published": "2022-12-15T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4226"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/c0ed80c8-ebbf-4ed9-b02f-31660097c352"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J9H8-CF5V-78MC
Vulnerability from github – Published: 2026-08-16 06:30 – Updated: 2026-08-16 06:30The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabinet) in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php. This is due to the handler loading an Appointment by the attacker-supplied params[id] without verifying that the appointment's staff_id matches the authenticated staff member, whereas sibling operations (deleteAppointment, saveAppointment, appointments list) correctly scope to $this->staff->getId() when $this->role === ROLE_STAFF. This makes it possible for authenticated attackers, with staff-level mobile cabinet access (any valid access_key token bound to a Staff entity), to read appointment details — including the internal note and the full customer_appointments collection (customer full_name, email, phone, notes, custom_fields, extras, payment_total, payment_type, payment_status) — belonging to other staff members by enumerating sequential appointment IDs.
{
"affected": [],
"aliases": [
"CVE-2026-12905"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-16T05:16:45Z",
"severity": "MODERATE"
},
"details": "The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabinet) in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php. This is due to the handler loading an Appointment by the attacker-supplied params[id] without verifying that the appointment\u0027s staff_id matches the authenticated staff member, whereas sibling operations (deleteAppointment, saveAppointment, appointments list) correctly scope to $this-\u003estaff-\u003egetId() when $this-\u003erole === ROLE_STAFF. This makes it possible for authenticated attackers, with staff-level mobile cabinet access (any valid access_key token bound to a Staff entity), to read appointment details \u2014 including the internal note and the full customer_appointments collection (customer full_name, email, phone, notes, custom_fields, extras, payment_total, payment_type, payment_status) \u2014 belonging to other staff members by enumerating sequential appointment IDs.",
"id": "GHSA-j9h8-cf5v-78mc",
"modified": "2026-08-16T06:30:24Z",
"published": "2026-08-16T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12905"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/24.9/frontend/modules/mobile_staff_cabinet/Ajax.php#L17"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/24.9/frontend/modules/mobile_staff_cabinet/api/handlers/Handler.php#L82"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/24.9/frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php#L70"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/frontend/modules/mobile_staff_cabinet/Ajax.php#L17"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/frontend/modules/mobile_staff_cabinet/api/handlers/Handler.php#L82"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php#L70"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3637918%40bookly-responsive-appointment-booking-tool\u0026new=3637918%40bookly-responsive-appointment-booking-tool"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1600466e-ad45-4dc7-916b-6c97301d2b03?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J9QF-MQGV-W6RW
Vulnerability from github – Published: 2025-04-15 21:31 – Updated: 2025-04-15 21:31Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
{
"affected": [],
"aliases": [
"CVE-2025-27938"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-15T21:15:55Z",
"severity": "MODERATE"
},
"details": "Unauthenticated attackers can obtain restricted information about a user\u0027s smart device collections (i.e., \"rooms\").",
"id": "GHSA-j9qf-mqgv-w6rw",
"modified": "2025-04-15T21:31:45Z",
"published": "2025-04-15T21:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27938"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J9W8-4M8F-75M4
Vulnerability from github – Published: 2025-12-11 06:30 – Updated: 2025-12-11 06:30GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries.
{
"affected": [],
"aliases": [
"CVE-2025-11247"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-11T05:16:35Z",
"severity": "MODERATE"
},
"details": "GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries.",
"id": "GHSA-j9w8-4m8f-75m4",
"modified": "2025-12-11T06:30:24Z",
"published": "2025-12-11T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11247"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3307422"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/573766"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J9XJ-CJF3-9JXJ
Vulnerability from github – Published: 2025-10-01 15:30 – Updated: 2025-10-21 21:33IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arbitrary organization.
{
"affected": [],
"aliases": [
"CVE-2025-59687"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-01T15:15:48Z",
"severity": "MODERATE"
},
"details": "IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arbitrary organization.",
"id": "GHSA-j9xj-cjf3-9jxj",
"modified": "2025-10-21T21:33:25Z",
"published": "2025-10-01T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59687"
},
{
"type": "WEB",
"url": "https://aurora-impaqtr.com"
},
{
"type": "WEB",
"url": "https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-59687"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JC6G-WHC6-QFJ3
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2023-08-02 00:30Windows TCP/IP Driver Security Feature Bypass Vulnerability
{
"affected": [],
"aliases": [
"CVE-2021-31970"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-08T23:15:00Z",
"severity": "MODERATE"
},
"details": "Windows TCP/IP Driver Security Feature Bypass Vulnerability",
"id": "GHSA-jc6g-whc6-qfj3",
"modified": "2023-08-02T00:30:34Z",
"published": "2022-05-24T19:04:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31970"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31970"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/163256/Microsoft-Windows-Filtering-Platform-Token-Access-Check-Privilege-Escalation.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JCHC-3PX4-V985
Vulnerability from github – Published: 2026-08-10 09:31 – Updated: 2026-08-11 18:30The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators.
{
"affected": [],
"aliases": [
"CVE-2026-18200"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T07:16:49Z",
"severity": "MODERATE"
},
"details": "The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators.",
"id": "GHSA-jchc-3px4-v985",
"modified": "2026-08-11T18:30:40Z",
"published": "2026-08-10T09:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18200"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/a5864653-4df6-4d8d-9f8a-ace7b0220342"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JCX9-WJX2-CCX2
Vulnerability from github – Published: 2025-11-08 06:30 – Updated: 2025-11-08 06:30The Groups plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.0 via the 'group_id' parameter of the group_join function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to register for groups other than ones set in the shortcode.
{
"affected": [],
"aliases": [
"CVE-2025-11748"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-08T04:15:43Z",
"severity": "MODERATE"
},
"details": "The Groups plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.0 via the \u0027group_id\u0027 parameter of the group_join function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to register for groups other than ones set in the shortcode.",
"id": "GHSA-jcx9-wjx2-ccx2",
"modified": "2025-11-08T06:30:26Z",
"published": "2025-11-08T06:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11748"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/groups/trunk/lib/views/class-groups-shortcodes.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3387846%40groups\u0026new=3387846%40groups\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f6d28a-d5ca-4700-bc61-f2dd20f06fcf?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JF2J-839Q-GGG6
Vulnerability from github – Published: 2026-09-09 03:30 – Updated: 2026-09-09 03:30Tanium addressed an improper access controls vulnerability in Comply.
{
"affected": [],
"aliases": [
"CVE-2026-87019"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T03:17:25Z",
"severity": "MODERATE"
},
"details": "Tanium addressed an improper access controls vulnerability in Comply.",
"id": "GHSA-jf2j-839q-ggg6",
"modified": "2026-09-09T03:30:46Z",
"published": "2026-09-09T03:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87019"
},
{
"type": "WEB",
"url": "https://security.tanium.com/TAN-2026-035"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JF5R-8HM2-F872
Vulnerability from github – Published: 2022-02-22 00:00 – Updated: 2026-02-03 22:10Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while the WHATWG URL parser will trim control characters and treat it as an absolute URL.
If url-parse is used in security decisions involving the hostname / protocol, and the input URL is used in a client which uses the WHATWG URL parser, the decision may be incorrect.
This can also lead to a cross-site scripting (XSS) vulnerability if url-parse is used to check for the javascript: protocol in URLs. See following example:
const parse = require('url-parse')
const express = require('express')
const app = express()
const port = 3000
url = parse(\"\\bjavascript:alert(1)\")
console.log(url)
app.get('/', (req, res) => {
if (url.protocol !== \"javascript:\") {res.send(\"<a href=\\'\" + url.href + \"\\'>CLICK ME!</a>\")}
})
app.listen(port, () => {
console.log(`Example app listening on port ${port}`)
})
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "url-parse"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.0"
},
{
"fixed": "1.5.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-0691"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-01T19:05:20Z",
"nvd_published_at": "2022-02-21T09:15:00Z",
"severity": "MODERATE"
},
"details": "Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while the WHATWG URL parser will trim control characters and treat it as an absolute URL.\n\nIf url-parse is used in security decisions involving the hostname / protocol, and the input URL is used in a client which uses the WHATWG URL parser, the decision may be incorrect.\n\nThis can also lead to a cross-site scripting (XSS) vulnerability if url-parse is used to check for the javascript: protocol in URLs. See following example:\n```js\nconst parse = require(\u0027url-parse\u0027)\nconst express = require(\u0027express\u0027)\nconst app = express()\nconst port = 3000\n\nurl = parse(\\\"\\\\bjavascript:alert(1)\\\")\n\nconsole.log(url)\n\napp.get(\u0027/\u0027, (req, res) =\u003e {\n if (url.protocol !== \\\"javascript:\\\") {res.send(\\\"\u003ca href=\\\\\u0027\\\" + url.href + \\\"\\\\\u0027\u003eCLICK ME!\u003c/a\u003e\\\")}\n })\n\napp.listen(port, () =\u003e {\n console.log(`Example app listening on port ${port}`)\n })\n```",
"id": "GHSA-jf5r-8hm2-f872",
"modified": "2026-02-03T22:10:35Z",
"published": "2022-02-22T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0691"
},
{
"type": "WEB",
"url": "https://github.com/github/advisory-database/pull/6765"
},
{
"type": "WEB",
"url": "https://github.com/unshiftio/url-parse/commit/0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63"
},
{
"type": "PACKAGE",
"url": "https://github.com/unshiftio/url-parse"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/57124ed5-4b68-4934-8325-2c546257f2e4"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220325-0006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "url-parse incorrectly parses hostname / protocol due to unstripped leading control characters."
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.