GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

4058 vulnerabilities reference this CWE, most recent first.

GHSA-VF5X-8R9F-VM4F

Vulnerability from github – Published: 2022-11-09 12:00 – Updated: 2025-02-20 21:30
VLAI
Details

Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2022-40206"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-08T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin \u003c= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.",
  "id": "GHSA-vf5x-8r9f-vm4f",
  "modified": "2025-02-20T21:30:42Z",
  "published": "2022-11-09T12:00:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40206"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/wpforo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VFF3-PQQ8-4CPQ

Vulnerability from github – Published: 2026-03-10 18:24 – Updated: 2026-03-11 20:57
VLAI
Summary
Craft Commerce: Potential IDOR in Commerce carts
Details

An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. This vulnerability enables the takeover of shopping sessions and potential exposure of PII.

Vulnerability Details

Root Cause

The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it.

// CartController.php:374-389 - actionLoadCart()
public function actionLoadCart(): ?Response
{
    $number = $this->request->getParam('number');

    if ($number === null) {
        return $this->asFailure(Craft::t('commerce', 'A cart number must be specified.'));
    }

    // No ownership check - returns any cart to any requester
    $cart = Order::find()->number($number)->isCompleted(false)->one();

    // Cart is loaded into attacker's session without authorization
    ...
}
// CartController.php:606-616 - _getCart()
$orderNumber = $this->request->getBodyParam('number');
if ($orderNumber) {
    // Same issue - no ownership validation
    $cart = Order::find()->number($orderNumber)->isCompleted(false)->one();
    // Returns cart to any requester who knows the number
}

Attack Scenario

Prerequisites

  • Target Craft Commerce installation with active shopping carts
  • Knowledge of a victim’s cart number (32-character hex string)

Cart Number Acquisition Vectors

  1. Referrer Header Leakage: Cart URLs shared externally expose the number
  2. Browser History: Accessible on shared/compromised devices
  3. Proxy/WAF Logs: Cart numbers logged in URL parameters
  4. Social Engineering: Support tickets, screenshots containing cart URLs
  5. Brute Force: While impractical for random targeting, feasible for targeted attacks against recently-created carts

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/commerce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/commerce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-31867"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-10T18:24:49Z",
    "nvd_published_at": "2026-03-11T18:16:25Z",
    "severity": "MODERATE"
  },
  "details": "An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce\u2019s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. This vulnerability enables the takeover of shopping sessions and potential exposure of PII.\n\n## Vulnerability Details\n\n### Root Cause\n\nThe `CartController` accepts a user-supplied `number` parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it.\n\n```php\n// CartController.php:374-389 - actionLoadCart()\npublic function actionLoadCart(): ?Response\n{\n    $number = $this-\u003erequest-\u003egetParam(\u0027number\u0027);\n\n    if ($number === null) {\n        return $this-\u003easFailure(Craft::t(\u0027commerce\u0027, \u0027A cart number must be specified.\u0027));\n    }\n\n    // No ownership check - returns any cart to any requester\n    $cart = Order::find()-\u003enumber($number)-\u003eisCompleted(false)-\u003eone();\n\n    // Cart is loaded into attacker\u0027s session without authorization\n    ...\n}\n```\n\n```php\n// CartController.php:606-616 - _getCart()\n$orderNumber = $this-\u003erequest-\u003egetBodyParam(\u0027number\u0027);\nif ($orderNumber) {\n    // Same issue - no ownership validation\n    $cart = Order::find()-\u003enumber($orderNumber)-\u003eisCompleted(false)-\u003eone();\n    // Returns cart to any requester who knows the number\n}\n```\n---\n\n## Attack Scenario\n\n### Prerequisites\n- Target Craft Commerce installation with active shopping carts\n- Knowledge of a victim\u2019s cart number (32-character hex string)\n\n### Cart Number Acquisition Vectors\n\n1. **Referrer Header Leakage**: Cart URLs shared externally expose the number\n2. **Browser History**: Accessible on shared/compromised devices\n3. **Proxy/WAF Logs**: Cart numbers logged in URL parameters\n4. **Social Engineering**: Support tickets, screenshots containing cart URLs\n5. **Brute Force**: While impractical for random targeting, feasible for targeted attacks against recently-created carts\n\n---",
  "id": "GHSA-vff3-pqq8-4cpq",
  "modified": "2026-03-11T20:57:29Z",
  "published": "2026-03-10T18:24:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/security/advisories/GHSA-vff3-pqq8-4cpq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31867"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/commerce/pull/4207"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/commerce"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft Commerce: Potential IDOR in Commerce carts"
}

GHSA-VFH4-9WWJ-77FX

Vulnerability from github – Published: 2025-09-10 09:30 – Updated: 2025-09-10 09:30
VLAI
Details

The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the 'MJ_gmgt_gmgt_add_user' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the email, password, and other details of any user, including Administrator users.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2025-7049"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-10T07:15:45Z",
    "severity": "HIGH"
  },
  "details": "The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the \u0027MJ_gmgt_gmgt_add_user\u0027 function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the email, password, and other details of any user, including Administrator users.",
  "id": "GHSA-vfh4-9wwj-77fx",
  "modified": "2025-09-10T09:30:58Z",
  "published": "2025-09-10T09:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7049"
    },
    {
      "type": "WEB",
      "url": "https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17951f68-8481-477b-a940-cce637f6ec54?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VFQC-MPFJ-GP23

Vulnerability from github – Published: 2026-07-27 15:32 – Updated: 2026-07-27 15:32
VLAI
Details

Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-59539"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-27T15:17:04Z",
    "severity": "HIGH"
  },
  "details": "Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions \u003c= 3.0.7 versions.",
  "id": "GHSA-vfqc-mpfj-gp23",
  "modified": "2026-07-27T15:32:32Z",
  "published": "2026-07-27T15:32:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59539"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-plugin-3-0-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VG32-RQH8-J8PM

Vulnerability from github – Published: 2026-06-25 21:31 – Updated: 2026-06-25 21:31
VLAI
Details

NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user's follows, replies, and social activity without authorization.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-56772"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T19:16:44Z",
    "severity": "MODERATE"
  },
  "details": "NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user\u0027s follows, replies, and social activity without authorization.",
  "id": "GHSA-vg32-rqh8-j8pm",
  "modified": "2026-06-25T21:31:30Z",
  "published": "2026-06-25T21:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56772"
    },
    {
      "type": "WEB",
      "url": "https://github.com/samuelclay/NewsBlur/commit/613c60b67cc46b3f4cae1dc2dfd8d717a39bc483"
    },
    {
      "type": "WEB",
      "url": "https://github.com/samuelclay/NewsBlur/releases/tag/Android_14.5.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/newsblur-insecure-direct-object-reference-in-social-interactions-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-VGF3-FPXC-H968

Vulnerability from github – Published: 2026-06-11 15:31 – Updated: 2026-06-11 15:31
VLAI
Details

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-8406"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-11T14:16:32Z",
    "severity": "HIGH"
  },
  "details": "openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.",
  "id": "GHSA-vgf3-fpxc-h968",
  "modified": "2026-06-11T15:31:34Z",
  "published": "2026-06-11T15:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8406"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OS4ED/openSIS-Classic/commit/c45d43146167324bae06bdf09de3e4bd2e5e478f"
    },
    {
      "type": "WEB",
      "url": "https://fluidattacks.com/es/advisories/melanie"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OS4ED/openSIS-Classic"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-VGMV-8XJC-6RCH

Vulnerability from github – Published: 2026-08-20 18:38 – Updated: 2026-08-20 18:38
VLAI
Summary
Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
Details

Summary

Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause() / addBaseClause() (e.g. tenant isolation, user ownership). However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query.

An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths.

Applications that rely on addBaseClause for row-level access control (multi-tenancy, per-user data isolation) are affected.

Impact

Any Backpack CRUD panel that uses addBaseClause or addClause to restrict which rows a user may access is affected on its write operations. An authenticated low-privilege user can modify or delete records belonging to other tenants / users.

Patches

Apply the fixed release for your major version:

  • v6: upgrade to 6.8.14 or later
  • v7: upgrade to 7.0.38 or later

The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side.

Workarounds

If you cannot upgrade immediately, add explicit Gate / Policy checks in your CrudController's update(), destroy(), and reorder() methods to verify the authenticated user is permitted to act on the resolved record.

Credits

Reported by Vishal Shukla (@shukla304).

Show details on source website

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.8.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.38"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54180"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:38:46Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nBackpack CRUD\u0027s list and read operations correctly apply any query scopes\nregistered via `addClause()` / `addBaseClause()` (e.g. tenant isolation, user\nownership). However, the **Update**, **Delete**, and **Reorder** operations\nbypassed these scopes, fetching records directly from the unscoped model query.\n\nAn authenticated user who knows or can guess a record\u0027s primary key could\ntherefore update, delete, or reorder records that should be invisible to them \u2014\na classic IDOR on write paths.\n\nApplications that rely on `addBaseClause` for row-level access control\n(multi-tenancy, per-user data isolation) are affected.\n\n## Impact\n\nAny Backpack CRUD panel that uses `addBaseClause` or `addClause` to restrict\nwhich rows a user may access is affected on its write operations.\nAn authenticated low-privilege user can modify or delete records belonging to\nother tenants / users.\n\n## Patches\n\nApply the fixed release for your major version:\n\n- **v6**: upgrade to **6.8.14** or later\n- **v7**: upgrade to **7.0.38** or later\n\nThe fix ensures Update, Delete, and Reorder all resolve records through the same\nscoped query used by the read side.\n\n## Workarounds\n\nIf you cannot upgrade immediately, add explicit `Gate` / `Policy` checks in your\n`CrudController`\u0027s `update()`, `destroy()`, and `reorder()` methods to verify\nthe authenticated user is permitted to act on the resolved record.\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)).",
  "id": "GHSA-vgmv-8xjc-6rch",
  "modified": "2026-08-20T18:38:46Z",
  "published": "2026-08-20T18:38:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-vgmv-8xjc-6rch"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)"
}

GHSA-VGP8-MH5V-WF9P

Vulnerability from github – Published: 2026-07-30 06:32 – Updated: 2026-07-30 18:31
VLAI
Details

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-15257"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-30T06:25:02Z",
    "severity": "MODERATE"
  },
  "details": "The RegistrationMagic  WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users\u0027 form submissions and the profile fields of the associated non-administrator WordPress accounts.",
  "id": "GHSA-vgp8-mh5v-wf9p",
  "modified": "2026-07-30T18:31:33Z",
  "published": "2026-07-30T06:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15257"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/fe6d0f6a-c2b4-4cd1-a7d2-e3afec76ebca"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VH24-W6W7-Q6MW

Vulnerability from github – Published: 2026-07-07 09:37 – Updated: 2026-07-07 09:37
VLAI
Details

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers.

This issue affects Ontime: through 04052026.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2026-5799"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-07T08:16:25Z",
    "severity": "HIGH"
  },
  "details": "Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers.\n\nThis issue affects Ontime: through 04052026.",
  "id": "GHSA-vh24-w6w7-q6mw",
  "modified": "2026-07-07T09:37:54Z",
  "published": "2026-07-07T09:37:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5799"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0503"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VH3G-J958-PVHC

Vulnerability from github – Published: 2026-07-29 18:31 – Updated: 2026-07-29 21:30
VLAI
Details

An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.

Show details on source website

{
  "affected": [],
  "aliases": [
    "CVE-2025-60931"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-29T17:16:50Z",
    "severity": "HIGH"
  },
  "details": "An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.",
  "id": "GHSA-vh3g-j958-pvhc",
  "modified": "2026-07-29T21:30:59Z",
  "published": "2026-07-29T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60931"
    },
    {
      "type": "WEB",
      "url": "https://docs.offsecguy.com/cve/infor/vulnerability/insecure-direct-object-references-idor"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.