Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3506 vulnerabilities reference this CWE, most recent first.
GHSA-X7W7-5275-WM7P
Vulnerability from github – Published: 2026-06-17 18:35 – Updated: 2026-06-17 18:35
VLAI
Details
Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2026-40768"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-17T13:20:37Z",
"severity": "HIGH"
},
"details": "Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system \u003c= 10.30.24 versions.",
"id": "GHSA-x7w7-5275-wm7p",
"modified": "2026-06-17T18:35:50Z",
"published": "2026-06-17T18:35:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40768"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-30-24-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-X7WC-2853-87FV
Vulnerability from github – Published: 2025-10-25 00:30 – Updated: 2025-10-25 00:30
VLAI
Details
GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API's object endpoints allow an authenticated user to request arbitrary user IDs and receive sensitive account data for those users, including the stored password and the account's security question and answer. The exposed recovery data and encrypted password may be used to reset or take over the target account.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-34293"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-24T22:15:40Z",
"severity": "HIGH"
},
"details": "GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API\u0027s object endpoints allow an authenticated user to request arbitrary user IDs and receive sensitive account data for those users, including the stored password and the account\u0027s security question and answer. The exposed recovery data and encrypted password may be used to reset or take over the target account.",
"id": "GHSA-x7wc-2853-87fv",
"modified": "2025-10-25T00:30:39Z",
"published": "2025-10-25T00:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34293"
},
{
"type": "WEB",
"url": "https://nne.navigacloud.com/GN4Help/gn4_introduction_to_gn4.htm"
},
{
"type": "WEB",
"url": "https://www.miles33.com/news/news/5955/naviga--miles-33--acquisition.html"
},
{
"type": "WEB",
"url": "https://www.miles33.com/section/14/gn4"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/gn4-publishing-system-idor-information-disclosure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X7X8-RFPP-V489
Vulnerability from github – Published: 2025-10-16 09:30 – Updated: 2025-10-16 09:30
VLAI
Details
The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the 'truelysell_edit_staff' shortcode.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-10742"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-16T07:15:32Z",
"severity": "CRITICAL"
},
"details": "The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the \u0027truelysell_edit_staff\u0027 shortcode.",
"id": "GHSA-x7x8-rfpp-v489",
"modified": "2025-10-16T09:30:24Z",
"published": "2025-10-16T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10742"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/truelysell-service-booking-wordpress-theme/43398124"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a636e865-9556-4afb-8726-4537a160f379?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X83G-979R-F5FH
Vulnerability from github – Published: 2026-07-31 16:52 – Updated: 2026-07-31 16:52
VLAI
Summary
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII
Details
Impact
Two unauthenticated Mollie shop endpoints look up orders by a sequential integer orderId
with no ownership or session check. Chained, they expose customer PII.
GET /{_locale}/thank-you (PageRedirectController::thankYouAction, route
sylius_mollie_shop_thank_you_page_redirect) loads the order with findOneBy(['id' => $orderId])
and returns a 302 whose Location header carries that order's tokenValue. Any orderId
thus yields that order's token. A non-existent id dereferences null and returns a 500. The
handler also writes the raw orderId into the session.
GET /{_locale}/get-code (QrCodeAction::fetchQrCodeFromOrder, route
sylius_mollie_shop_get_qr_code) runs the same lookup and returns the order's QR code and id
as JSON, ignoring the session cart; this is where the front-end got the integer id. A bad id
500s here too.
That tokenValue is the order's only access control. Passed to the Sylius core page
GET /{_locale}/register-after-checkout/{tokenValue} it returns a form pre-filled with the
customer's first name, last name and email. The full attack: enumerate orderId, read the
token from the redirect, read the PII, at roughly a 1-in-71 hit rate for guest orders.
register-after-checkout is Sylius core, not the plugin, and trusts the token by design, so
the leak is what must be fixed.
None of the plugin endpoints require a login, session or CSRF token.
Patches
Fixed in 2.2.8, 3.2.4 and 3.3.1.
Workarounds
If you cannot upgrade immediately, patch both endpoints at the project level by decorating
the plugin controllers. The decorators enforce ownership before delegating to the original
controller, so no plugin behaviour is lost. They keep the original orderId request contract,
so no front-end or asset changes are required. Works on both 2.2 and 3.x.
Step 1. Decorate the QR code controller
Create src/Controller/Mollie/SecureQrCodeAction.php in your Sylius project:
<?php
declare(strict_types=1);
namespace App\Controller\Mollie;
use Sylius\Component\Order\Context\CartContextInterface;
use Sylius\Component\Order\Context\CartNotFoundException;
use Sylius\MolliePlugin\Controller\Shop\QrCodeAction;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
final class SecureQrCodeAction
{
private const OWNED_ORDER_IDS_SESSION_KEY = 'sylius_mollie.owned_order_ids';
public function __construct(
private readonly QrCodeAction $inner,
private readonly CartContextInterface $cartContext,
) {
}
public function fetchQrCodeFromOrder(Request $request): JsonResponse
{
$orderId = $request->get('orderId');
try {
$cart = $this->cartContext->getCart();
} catch (CartNotFoundException) {
$cart = null;
}
if (null !== $orderId && (null === $cart || (string) $cart->getId() !== (string) $orderId)) {
return new JsonResponse([], Response::HTTP_FORBIDDEN);
}
if (null !== $cart && null !== $cart->getId() && $request->hasSession()) {
$session = $request->getSession();
$ownedIds = $session->get(self::OWNED_ORDER_IDS_SESSION_KEY, []);
$ownedIds[(string) $cart->getId()] = true;
$session->set(self::OWNED_ORDER_IDS_SESSION_KEY, $ownedIds);
}
return $this->inner->fetchQrCodeFromOrder($request);
}
public function createPayment(Request $request): Response
{
return $this->inner->createPayment($request);
}
public function removeQrCodeFromOrder(Request $request): JsonResponse
{
return $this->inner->removeQrCodeFromOrder($request);
}
}
Step 2. Decorate the thank-you controller
Create src/Controller/Mollie/SecurePageRedirectController.php:
<?php
declare(strict_types=1);
namespace App\Controller\Mollie;
use Sylius\MolliePlugin\Controller\Shop\PageRedirectController;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\Routing\RouterInterface;
final class SecurePageRedirectController
{
private const OWNED_ORDER_IDS_SESSION_KEY = 'sylius_mollie.owned_order_ids';
public function __construct(
private readonly PageRedirectController $inner,
private readonly RouterInterface $router,
) {
}
public function thankYouAction(Request $request, SessionInterface $session): RedirectResponse
{
$orderId = $request->get('orderId');
if (null !== $orderId) {
$ownedIds = $session->get(self::OWNED_ORDER_IDS_SESSION_KEY, []);
if (!isset($ownedIds[(string) $orderId])) {
return new RedirectResponse($this->router->generate('sylius_shop_cart_summary'));
}
}
return $this->inner->thankYouAction($request, $session);
}
}
Step 3. Register the decorators
Append to your project's config/services.yaml:
services:
App\Controller\Mollie\SecureQrCodeAction:
decorates: sylius_mollie.controller.shop.qr_code
public: true
arguments:
$inner: '@.inner'
$cartContext: '@sylius.context.cart'
App\Controller\Mollie\SecurePageRedirectController:
decorates: sylius_mollie.controller.shop.page_redirect
public: true
arguments:
$inner: '@.inner'
$router: '@router'
Both decorators keep
@.innerand only add an ownership check onorderIdbefore handing the request to the original action, socreatePayment,removeQrCodeFromOrderand the thank-you redirect all keep their original behaviour and the front-end contract is unchanged.
Step 4. Clear the cache
bin/console cache:clear
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "sylius/mollie-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "sylius/mollie-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "sylius/mollie-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-68501"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T16:52:59Z",
"nvd_published_at": "2026-07-30T21:18:13Z",
"severity": "MODERATE"
},
"details": "### Impact\nTwo unauthenticated Mollie shop endpoints look up orders by a sequential integer `orderId`\nwith no ownership or session check. Chained, they expose customer PII.\n\n`GET /{_locale}/thank-you` (`PageRedirectController::thankYouAction`, route\n`sylius_mollie_shop_thank_you_page_redirect`) loads the order with `findOneBy([\u0027id\u0027 =\u003e $orderId])`\nand returns a `302` whose `Location` header carries that order\u0027s `tokenValue`. Any `orderId`\nthus yields that order\u0027s token. A non-existent id dereferences null and returns a `500`. The\nhandler also writes the raw `orderId` into the session.\n\n`GET /{_locale}/get-code` (`QrCodeAction::fetchQrCodeFromOrder`, route\n`sylius_mollie_shop_get_qr_code`) runs the same lookup and returns the order\u0027s QR code and id\nas JSON, ignoring the session cart; this is where the front-end got the integer id. A bad id\n`500`s here too.\n\nThat `tokenValue` is the order\u0027s only access control. Passed to the Sylius core page\n`GET /{_locale}/register-after-checkout/{tokenValue}` it returns a form pre-filled with the\ncustomer\u0027s first name, last name and email. The full attack: enumerate `orderId`, read the\ntoken from the redirect, read the PII, at roughly a 1-in-71 hit rate for guest orders.\n`register-after-checkout` is Sylius core, not the plugin, and trusts the token by design, so\nthe leak is what must be fixed.\n\nNone of the plugin endpoints require a login, session or CSRF token.\n\n### Patches\nFixed in **2.2.8**, **3.2.4** and **3.3.1**. \n\n### Workarounds\nIf you cannot upgrade immediately, patch both endpoints at the project level by decorating\nthe plugin controllers. The decorators enforce ownership before delegating to the original\ncontroller, so no plugin behaviour is lost. They keep the original `orderId` request contract,\nso no front-end or asset changes are required. Works on both 2.2 and 3.x.\n\n#### Step 1. Decorate the QR code controller\nCreate `src/Controller/Mollie/SecureQrCodeAction.php` in your Sylius project:\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\Controller\\Mollie;\n\nuse Sylius\\Component\\Order\\Context\\CartContextInterface;\nuse Sylius\\Component\\Order\\Context\\CartNotFoundException;\nuse Sylius\\MolliePlugin\\Controller\\Shop\\QrCodeAction;\nuse Symfony\\Component\\HttpFoundation\\JsonResponse;\nuse Symfony\\Component\\HttpFoundation\\Request;\nuse Symfony\\Component\\HttpFoundation\\Response;\n\nfinal class SecureQrCodeAction\n{\n private const OWNED_ORDER_IDS_SESSION_KEY = \u0027sylius_mollie.owned_order_ids\u0027;\n\n public function __construct(\n private readonly QrCodeAction $inner,\n private readonly CartContextInterface $cartContext,\n ) {\n }\n\n public function fetchQrCodeFromOrder(Request $request): JsonResponse\n {\n $orderId = $request-\u003eget(\u0027orderId\u0027);\n\n try {\n $cart = $this-\u003ecartContext-\u003egetCart();\n } catch (CartNotFoundException) {\n $cart = null;\n }\n\n if (null !== $orderId \u0026\u0026 (null === $cart || (string) $cart-\u003egetId() !== (string) $orderId)) {\n return new JsonResponse([], Response::HTTP_FORBIDDEN);\n }\n\n if (null !== $cart \u0026\u0026 null !== $cart-\u003egetId() \u0026\u0026 $request-\u003ehasSession()) {\n $session = $request-\u003egetSession();\n $ownedIds = $session-\u003eget(self::OWNED_ORDER_IDS_SESSION_KEY, []);\n $ownedIds[(string) $cart-\u003egetId()] = true;\n $session-\u003eset(self::OWNED_ORDER_IDS_SESSION_KEY, $ownedIds);\n }\n\n return $this-\u003einner-\u003efetchQrCodeFromOrder($request);\n }\n\n public function createPayment(Request $request): Response\n {\n return $this-\u003einner-\u003ecreatePayment($request);\n }\n\n public function removeQrCodeFromOrder(Request $request): JsonResponse\n {\n return $this-\u003einner-\u003eremoveQrCodeFromOrder($request);\n }\n}\n```\n\n#### Step 2. Decorate the thank-you controller\nCreate `src/Controller/Mollie/SecurePageRedirectController.php`:\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\Controller\\Mollie;\n\nuse Sylius\\MolliePlugin\\Controller\\Shop\\PageRedirectController;\nuse Symfony\\Component\\HttpFoundation\\RedirectResponse;\nuse Symfony\\Component\\HttpFoundation\\Request;\nuse Symfony\\Component\\HttpFoundation\\Session\\SessionInterface;\nuse Symfony\\Component\\Routing\\RouterInterface;\n\nfinal class SecurePageRedirectController\n{\n private const OWNED_ORDER_IDS_SESSION_KEY = \u0027sylius_mollie.owned_order_ids\u0027;\n\n public function __construct(\n private readonly PageRedirectController $inner,\n private readonly RouterInterface $router,\n ) {\n }\n\n public function thankYouAction(Request $request, SessionInterface $session): RedirectResponse\n {\n $orderId = $request-\u003eget(\u0027orderId\u0027);\n\n if (null !== $orderId) {\n $ownedIds = $session-\u003eget(self::OWNED_ORDER_IDS_SESSION_KEY, []);\n\n if (!isset($ownedIds[(string) $orderId])) {\n return new RedirectResponse($this-\u003erouter-\u003egenerate(\u0027sylius_shop_cart_summary\u0027));\n }\n }\n\n return $this-\u003einner-\u003ethankYouAction($request, $session);\n }\n}\n```\n\n#### Step 3. Register the decorators\nAppend to your project\u0027s `config/services.yaml`:\n\n```yaml\nservices:\n App\\Controller\\Mollie\\SecureQrCodeAction:\n decorates: sylius_mollie.controller.shop.qr_code\n public: true\n arguments:\n $inner: \u0027@.inner\u0027\n $cartContext: \u0027@sylius.context.cart\u0027\n\n App\\Controller\\Mollie\\SecurePageRedirectController:\n decorates: sylius_mollie.controller.shop.page_redirect\n public: true\n arguments:\n $inner: \u0027@.inner\u0027\n $router: \u0027@router\u0027\n```\n\n\u003e Both decorators keep `@.inner` and only add an ownership check on `orderId` before handing\n\u003e the request to the original action, so `createPayment`, `removeQrCodeFromOrder` and the\n\u003e thank-you redirect all keep their original behaviour and the front-end contract is unchanged.\n\n#### Step 4. Clear the cache\n```bash\nbin/console cache:clear\n```",
"id": "GHSA-x83g-979r-f5fh",
"modified": "2026-07-31T16:52:59Z",
"published": "2026-07-31T16:52:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-x83g-979r-f5fh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68501"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/pull/351"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/pull/352"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/pull/354"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/commit/01316b3ad3cf82e3c5ad160115d0a2cf89174e49"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/commit/153c754486b1bc597b67a90ac07ef71cd7958267"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/commit/d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a"
},
{
"type": "PACKAGE",
"url": "https://github.com/Sylius/MolliePlugin"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4"
},
{
"type": "WEB",
"url": "https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII"
}
GHSA-X847-VXVJ-G6RJ
Vulnerability from github – Published: 2022-06-03 00:01 – Updated: 2022-06-14 00:00
VLAI
Details
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-1949"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-02T14:15:00Z",
"severity": "HIGH"
},
"details": "An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.",
"id": "GHSA-x847-vxvj-g6rj",
"modified": "2022-06-14T00:00:37Z",
"published": "2022-06-03T00:01:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1949"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2091781"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X8P6-MR22-V5C9
Vulnerability from github – Published: 2024-03-31 21:30 – Updated: 2026-04-28 21:34
VLAI
Details
Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-30543"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-31T19:15:47Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.",
"id": "GHSA-x8p6-mr22-v5c9",
"modified": "2026-04-28T21:34:29Z",
"published": "2024-03-31T21:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30543"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/whizzy/wordpress-whizzy-plugin-1-1-18-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X8QQ-M4QC-RPJ5
Vulnerability from github – Published: 2026-07-16 15:33 – Updated: 2026-07-16 15:33
VLAI
Details
Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user's company.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-59237"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-16T15:16:34Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or DELETE /api/order-item/{id}, because the controllers resolve records with Order::find($id) / Item::find($id) without scoping by the authenticated user\u0027s company.",
"id": "GHSA-x8qq-m4qc-rpj5",
"modified": "2026-07-16T15:33:11Z",
"published": "2026-07-16T15:33:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59237"
},
{
"type": "WEB",
"url": "https://github.com/Roskus/prospero-flow-crm/commit/9a859c4de3d49674916773d346c60d89ad7febe0"
},
{
"type": "WEB",
"url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3"
},
{
"type": "WEB",
"url": "https://secur0.com/en/cna/cve-list/cve-2026-59237-idor-in-prospero-flow-crm-order-api-allows-cross-tenant-read-and-modification-of-orders"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X8VJ-X24H-RRFV
Vulnerability from github – Published: 2024-04-24 12:30 – Updated: 2025-02-04 18:30
VLAI
Details
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-32808"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T11:15:48Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.",
"id": "GHSA-x8vj-x24h-rrfv",
"modified": "2025-02-04T18:30:45Z",
"published": "2024-04-24T12:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32808"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-plugin-5-7-9-insecure-direct-object-reference-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-X974-724G-RVVR
Vulnerability from github – Published: 2022-10-17 19:00 – Updated: 2022-10-20 19:00
VLAI
Details
An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Zentao project issues.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-3331"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-17T16:15:00Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab\u0027s Zentao integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Zentao project issues.",
"id": "GHSA-x974-724g-rvvr",
"modified": "2022-10-20T19:00:35Z",
"published": "2022-10-17T19:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3331"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1542834"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3331.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/360372"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X97M-F58V-9CWG
Vulnerability from github – Published: 2026-06-12 18:31 – Updated: 2026-06-30 03:37
VLAI
Details
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-45832"
],
"database_specific": {
"cwe_ids": [
"CWE-551",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-12T16:16:28Z",
"severity": "HIGH"
},
"details": "All V1 collection-level endpoints in ChromaDB\u0027s Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.",
"id": "GHSA-x97m-f58v-9cwg",
"modified": "2026-06-30T03:37:02Z",
"published": "2026-06-12T18:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45832"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-45832"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488411"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45832.json"
},
{
"type": "WEB",
"url": "https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.