CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4058 vulnerabilities reference this CWE, most recent first.
GHSA-VF5X-8R9F-VM4F
Vulnerability from github – Published: 2022-11-09 12:00 – Updated: 2025-02-20 21:30Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.
{
"affected": [],
"aliases": [
"CVE-2022-40206"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-08T19:15:00Z",
"severity": "MODERATE"
},
"details": "Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin \u003c= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.",
"id": "GHSA-vf5x-8r9f-vm4f",
"modified": "2025-02-20T21:30:42Z",
"published": "2022-11-09T12:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40206"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/wpforo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VFF3-PQQ8-4CPQ
Vulnerability from github – Published: 2026-03-10 18:24 – Updated: 2026-03-11 20:57An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. This vulnerability enables the takeover of shopping sessions and potential exposure of PII.
Vulnerability Details
Root Cause
The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it.
// CartController.php:374-389 - actionLoadCart()
public function actionLoadCart(): ?Response
{
$number = $this->request->getParam('number');
if ($number === null) {
return $this->asFailure(Craft::t('commerce', 'A cart number must be specified.'));
}
// No ownership check - returns any cart to any requester
$cart = Order::find()->number($number)->isCompleted(false)->one();
// Cart is loaded into attacker's session without authorization
...
}
// CartController.php:606-616 - _getCart()
$orderNumber = $this->request->getBodyParam('number');
if ($orderNumber) {
// Same issue - no ownership validation
$cart = Order::find()->number($orderNumber)->isCompleted(false)->one();
// Returns cart to any requester who knows the number
}
Attack Scenario
Prerequisites
- Target Craft Commerce installation with active shopping carts
- Knowledge of a victim’s cart number (32-character hex string)
Cart Number Acquisition Vectors
- Referrer Header Leakage: Cart URLs shared externally expose the number
- Browser History: Accessible on shared/compromised devices
- Proxy/WAF Logs: Cart numbers logged in URL parameters
- Social Engineering: Support tickets, screenshots containing cart URLs
- Brute Force: While impractical for random targeting, feasible for targeted attacks against recently-created carts
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "craftcms/commerce"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.6.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "craftcms/commerce"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-31867"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-10T18:24:49Z",
"nvd_published_at": "2026-03-11T18:16:25Z",
"severity": "MODERATE"
},
"details": "An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce\u2019s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. This vulnerability enables the takeover of shopping sessions and potential exposure of PII.\n\n## Vulnerability Details\n\n### Root Cause\n\nThe `CartController` accepts a user-supplied `number` parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it.\n\n```php\n// CartController.php:374-389 - actionLoadCart()\npublic function actionLoadCart(): ?Response\n{\n $number = $this-\u003erequest-\u003egetParam(\u0027number\u0027);\n\n if ($number === null) {\n return $this-\u003easFailure(Craft::t(\u0027commerce\u0027, \u0027A cart number must be specified.\u0027));\n }\n\n // No ownership check - returns any cart to any requester\n $cart = Order::find()-\u003enumber($number)-\u003eisCompleted(false)-\u003eone();\n\n // Cart is loaded into attacker\u0027s session without authorization\n ...\n}\n```\n\n```php\n// CartController.php:606-616 - _getCart()\n$orderNumber = $this-\u003erequest-\u003egetBodyParam(\u0027number\u0027);\nif ($orderNumber) {\n // Same issue - no ownership validation\n $cart = Order::find()-\u003enumber($orderNumber)-\u003eisCompleted(false)-\u003eone();\n // Returns cart to any requester who knows the number\n}\n```\n---\n\n## Attack Scenario\n\n### Prerequisites\n- Target Craft Commerce installation with active shopping carts\n- Knowledge of a victim\u2019s cart number (32-character hex string)\n\n### Cart Number Acquisition Vectors\n\n1. **Referrer Header Leakage**: Cart URLs shared externally expose the number\n2. **Browser History**: Accessible on shared/compromised devices\n3. **Proxy/WAF Logs**: Cart numbers logged in URL parameters\n4. **Social Engineering**: Support tickets, screenshots containing cart URLs\n5. **Brute Force**: While impractical for random targeting, feasible for targeted attacks against recently-created carts\n\n---",
"id": "GHSA-vff3-pqq8-4cpq",
"modified": "2026-03-11T20:57:29Z",
"published": "2026-03-10T18:24:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/craftcms/commerce/security/advisories/GHSA-vff3-pqq8-4cpq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31867"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/commerce/pull/4207"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftcms/commerce"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Craft Commerce: Potential IDOR in Commerce carts"
}
GHSA-VFH4-9WWJ-77FX
Vulnerability from github – Published: 2025-09-10 09:30 – Updated: 2025-09-10 09:30The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the 'MJ_gmgt_gmgt_add_user' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the email, password, and other details of any user, including Administrator users.
{
"affected": [],
"aliases": [
"CVE-2025-7049"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-10T07:15:45Z",
"severity": "HIGH"
},
"details": "The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the \u0027MJ_gmgt_gmgt_add_user\u0027 function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the email, password, and other details of any user, including Administrator users.",
"id": "GHSA-vfh4-9wwj-77fx",
"modified": "2025-09-10T09:30:58Z",
"published": "2025-09-10T09:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7049"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17951f68-8481-477b-a940-cce637f6ec54?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VFQC-MPFJ-GP23
Vulnerability from github – Published: 2026-07-27 15:32 – Updated: 2026-07-27 15:32Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.
{
"affected": [],
"aliases": [
"CVE-2026-59539"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-27T15:17:04Z",
"severity": "HIGH"
},
"details": "Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions \u003c= 3.0.7 versions.",
"id": "GHSA-vfqc-mpfj-gp23",
"modified": "2026-07-27T15:32:32Z",
"published": "2026-07-27T15:32:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59539"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-plugin-3-0-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VG32-RQH8-J8PM
Vulnerability from github – Published: 2026-06-25 21:31 – Updated: 2026-06-25 21:31NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user's follows, replies, and social activity without authorization.
{
"affected": [],
"aliases": [
"CVE-2026-56772"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T19:16:44Z",
"severity": "MODERATE"
},
"details": "NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user\u0027s follows, replies, and social activity without authorization.",
"id": "GHSA-vg32-rqh8-j8pm",
"modified": "2026-06-25T21:31:30Z",
"published": "2026-06-25T21:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56772"
},
{
"type": "WEB",
"url": "https://github.com/samuelclay/NewsBlur/commit/613c60b67cc46b3f4cae1dc2dfd8d717a39bc483"
},
{
"type": "WEB",
"url": "https://github.com/samuelclay/NewsBlur/releases/tag/Android_14.5.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/newsblur-insecure-direct-object-reference-in-social-interactions-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VGF3-FPXC-H968
Vulnerability from github – Published: 2026-06-11 15:31 – Updated: 2026-06-11 15:31openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.
{
"affected": [],
"aliases": [
"CVE-2026-8406"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-11T14:16:32Z",
"severity": "HIGH"
},
"details": "openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.",
"id": "GHSA-vgf3-fpxc-h968",
"modified": "2026-06-11T15:31:34Z",
"published": "2026-06-11T15:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8406"
},
{
"type": "WEB",
"url": "https://github.com/OS4ED/openSIS-Classic/commit/c45d43146167324bae06bdf09de3e4bd2e5e478f"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/es/advisories/melanie"
},
{
"type": "WEB",
"url": "https://github.com/OS4ED/openSIS-Classic"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VGMV-8XJC-6RCH
Vulnerability from github – Published: 2026-08-20 18:38 – Updated: 2026-08-20 18:38Summary
Backpack CRUD's list and read operations correctly apply any query scopes
registered via addClause() / addBaseClause() (e.g. tenant isolation, user
ownership). However, the Update, Delete, and Reorder operations
bypassed these scopes, fetching records directly from the unscoped model query.
An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths.
Applications that rely on addBaseClause for row-level access control
(multi-tenancy, per-user data isolation) are affected.
Impact
Any Backpack CRUD panel that uses addBaseClause or addClause to restrict
which rows a user may access is affected on its write operations.
An authenticated low-privilege user can modify or delete records belonging to
other tenants / users.
Patches
Apply the fixed release for your major version:
- v6: upgrade to 6.8.14 or later
- v7: upgrade to 7.0.38 or later
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side.
Workarounds
If you cannot upgrade immediately, add explicit Gate / Policy checks in your
CrudController's update(), destroy(), and reorder() methods to verify
the authenticated user is permitted to act on the resolved record.
Credits
Reported by Vishal Shukla (@shukla304).
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "backpack/crud"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.8.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "backpack/crud"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.38"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54180"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-20T18:38:46Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nBackpack CRUD\u0027s list and read operations correctly apply any query scopes\nregistered via `addClause()` / `addBaseClause()` (e.g. tenant isolation, user\nownership). However, the **Update**, **Delete**, and **Reorder** operations\nbypassed these scopes, fetching records directly from the unscoped model query.\n\nAn authenticated user who knows or can guess a record\u0027s primary key could\ntherefore update, delete, or reorder records that should be invisible to them \u2014\na classic IDOR on write paths.\n\nApplications that rely on `addBaseClause` for row-level access control\n(multi-tenancy, per-user data isolation) are affected.\n\n## Impact\n\nAny Backpack CRUD panel that uses `addBaseClause` or `addClause` to restrict\nwhich rows a user may access is affected on its write operations.\nAn authenticated low-privilege user can modify or delete records belonging to\nother tenants / users.\n\n## Patches\n\nApply the fixed release for your major version:\n\n- **v6**: upgrade to **6.8.14** or later\n- **v7**: upgrade to **7.0.38** or later\n\nThe fix ensures Update, Delete, and Reorder all resolve records through the same\nscoped query used by the read side.\n\n## Workarounds\n\nIf you cannot upgrade immediately, add explicit `Gate` / `Policy` checks in your\n`CrudController`\u0027s `update()`, `destroy()`, and `reorder()` methods to verify\nthe authenticated user is permitted to act on the resolved record.\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)).",
"id": "GHSA-vgmv-8xjc-6rch",
"modified": "2026-08-20T18:38:46Z",
"published": "2026-08-20T18:38:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-vgmv-8xjc-6rch"
},
{
"type": "PACKAGE",
"url": "https://github.com/Laravel-Backpack/CRUD"
},
{
"type": "WEB",
"url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
},
{
"type": "WEB",
"url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)"
}
GHSA-VGP8-MH5V-WF9P
Vulnerability from github – Published: 2026-07-30 06:32 – Updated: 2026-07-30 18:31The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.
{
"affected": [],
"aliases": [
"CVE-2026-15257"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T06:25:02Z",
"severity": "MODERATE"
},
"details": "The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users\u0027 form submissions and the profile fields of the associated non-administrator WordPress accounts.",
"id": "GHSA-vgp8-mh5v-wf9p",
"modified": "2026-07-30T18:31:33Z",
"published": "2026-07-30T06:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15257"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/fe6d0f6a-c2b4-4cd1-a7d2-e3afec76ebca"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VH24-W6W7-Q6MW
Vulnerability from github – Published: 2026-07-07 09:37 – Updated: 2026-07-07 09:37Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers.
This issue affects Ontime: through 04052026.
{
"affected": [],
"aliases": [
"CVE-2026-5799"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-07T08:16:25Z",
"severity": "HIGH"
},
"details": "Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers.\n\nThis issue affects Ontime: through 04052026.",
"id": "GHSA-vh24-w6w7-q6mw",
"modified": "2026-07-07T09:37:54Z",
"published": "2026-07-07T09:37:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5799"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0503"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VH3G-J958-PVHC
Vulnerability from github – Published: 2026-07-29 18:31 – Updated: 2026-07-29 21:30An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.
{
"affected": [],
"aliases": [
"CVE-2025-60931"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-29T17:16:50Z",
"severity": "HIGH"
},
"details": "An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.",
"id": "GHSA-vh3g-j958-pvhc",
"modified": "2026-07-29T21:30:59Z",
"published": "2026-07-29T18:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60931"
},
{
"type": "WEB",
"url": "https://docs.offsecguy.com/cve/infor/vulnerability/insecure-direct-object-references-idor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.