CWE-639

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "concrete5/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-22951"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-22T18:21:13Z",
    "nvd_published_at": "2021-11-19T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.",
  "id": "GHSA-rhf5-f553-xg82",
  "modified": "2021-11-22T18:22:30Z",
  "published": "2021-11-23T18:18:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22951"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1102014"
    },
    {
      "type": "WEB",
      "url": "https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Password exposure in concrete5/core"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-10868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-23T04:15:07Z",
    "severity": "MODERATE"
  },
  "details": "The Enter Addons \u2013 Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.9 via the Advanced Tabs widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.",
  "id": "GHSA-rhmp-r3fw-ggrc",
  "modified": "2026-04-08T21:32:57Z",
  "published": "2024-11-23T06:32:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10868"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3195822%40enteraddons%2Ftrunk\u0026old=3148550%40enteraddons%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/enteraddons"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff8e8889-ec02-4b8d-9509-2c6335fdd9a4?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-67919"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-08T10:15:50Z",
    "severity": "HIGH"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through \u003c= 5.4.30.",
  "id": "GHSA-rhq7-g7ch-6mm7",
  "modified": "2026-01-20T15:33:09Z",
  "published": "2026-01-08T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67919"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/woffice-core/vulnerability/wordpress-woffice-core-plugin-5-4-30-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/woffice-core/vulnerability/wordpress-woffice-core-plugin-5-4-30-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-13932"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-04T22:15:47Z",
    "severity": "HIGH"
  },
  "details": "The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.",
  "id": "GHSA-rj4p-qc9g-j2p3",
  "modified": "2025-12-05T00:31:05Z",
  "published": "2025-12-05T00:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13932"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-06"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.21"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@better-auth/scim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0-beta.27"
            },
            {
              "fixed": "1.6.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.7.0-beta.9"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@better-auth/scim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0-beta.0"
            },
            {
              "fixed": "1.7.0-beta.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T15:40:54Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Am I affected?\n\nYou are affected if your application registers the `@better-auth/scim` plugin and lets authenticated users generate SCIM tokens. The default `canGenerateToken` policy was affected, and custom policies were affected when they did not reject provider IDs already used by other account providers. The provider-ID collision issue additionally requires SSO, SAML, OIDC, generic OAuth, or social providers whose account rows use custom provider IDs, plus existing account rows under those IDs.\n\nThe deprovisioning and email-update issues require only the SCIM plugin and a valid SCIM bearer token. Published versions from `@better-auth/scim@1.4.0-beta.27` through `1.6.21` are affected. Beta versions from `1.7.0-beta.0` through `1.7.0-beta.9` are affected. Upgrade to `@better-auth/scim@1.6.22` or `1.7.0-beta.10`.\n\n### Summary\n\n`@better-auth/scim` used the same logical provider ID for SCIM provider configuration and account ownership. SCIM token issuance did not reject all account-provider namespaces. An authenticated user could therefore mint a SCIM token whose provider ID matched an existing SSO, SAML, OIDC, generic OAuth, or social provider. SCIM user routes then selected account rows by that provider ID and treated those users as SCIM-managed, even when the SCIM token had never provisioned them.\n\nThe same write path had 2 additional validation issues. First, SCIM `active: false` was not modeled, so identity providers could receive a successful response while the user stayed active. Second, SCIM PUT and PATCH updates changed global email addresses without the same uniqueness check used by create, and `emailVerified` stayed unchanged after an email reassignment.\n\n### Details\n\nThe SCIM bearer middleware decoded the provider ID from the bearer token and loaded the matching `scimProvider` row. User listing and user lookup then queried ordinary account rows by `account.providerId`. This made the provider ID a user-controlled authorization key. If a SCIM token used a provider ID that belonged to SSO, SAML, OIDC, generic OAuth, or another account provider, the SCIM routes could resolve users that the token did not own.\n\nThe highest-impact path was non-organization deletion. On affected versions, `DELETE /scim/v2/Users/:id` for a non-organization SCIM token deleted the global Better Auth user and their sessions after resolving the user through the colliding provider ID. A low-privileged authenticated user could therefore delete users associated with a colliding provider namespace.\n\nOrganization-scoped tokens were also affected by the provider-ID collision. If the colliding provider ID matched the organization\u0027s SSO or OIDC connection, SCIM PUT or PATCH could resolve an SSO-provisioned organization member and rewrite global profile fields. Before the patch, changing a user\u0027s email through SCIM skipped the uniqueness check and left `emailVerified` unchanged.\n\nSCIM deactivation had a separate failure mode. The SCIM `active` attribute was missing from the user schemas and PATCH mapping, so `active: false` was stripped from requests. A standard identity-provider deactivation signal could return success while the user kept their identity, sessions, and access.\n\n### Patches\n\nFixed in `@better-auth/scim@1.6.22` and `@better-auth/scim@1.7.0-beta.10`.\n\nThe patch rejects SCIM provider IDs that collide with built-in providers, configured social providers, generic OAuth providers, and SSO provider rows before a token is minted. It also scopes SCIM deletion to the SCIM account link when the user has other identities. The global user is deleted only when the SCIM account is the user\u0027s sole linked account.\n\nThe patch models the SCIM `active` attribute. App-level SCIM deactivation maps `active: false` to the admin plugin\u0027s enforced disabled-user state and revokes sessions. If the admin plugin is absent, the request is rejected instead of being silently dropped.\n\nThe patch adds the email uniqueness check to SCIM PUT and PATCH updates and resets `emailVerified` whenever SCIM changes a user\u0027s email.\n\n### Workarounds\n\nIf you cannot upgrade immediately, configure `canGenerateToken` to reject provider IDs that match any account provider ID used by your application. Include built-in providers, social providers, generic OAuth providers, SSO, SAML, and OIDC provider IDs. Also restrict which users can generate SCIM tokens.\n\nDo not rely on deactivation reports from your identity provider until you have upgraded. Confirm that deactivated users have actually lost access, especially if your identity provider deprovisions through `active: false`.\n\nIf you use SCIM account linking, avoid broad domain-based linking rules. A shared email domain is not proof that a SCIM token may manage a pre-existing user. Prefer organization-membership checks or an explicit application predicate.\n\nAudit existing `scimProvider` rows and remove any row whose `providerId` matches another account provider namespace.\n\n### Impact\n\nWith the provider-ID collision issue, an authenticated attacker could act through a provider namespace they did not own. They could list and read SCIM user resources for users linked to the colliding provider. They could also update profile and account fields and delete global user records on the non-organization path. In organization-scoped deployments, a colliding token could mutate global profile fields for SSO-provisioned organization members.\n\nWith the deactivation issue, a terminated user could remain active after an identity provider reported successful deprovisioning through `active: false`. With the email-update issue, SCIM could assign one user\u0027s email to another user on adapters without an enforced unique index. That could corrupt email-keyed login and lookup, while SQL adapters could raise an unhandled adapter error.\n\n### Credit\n\nFound through internal validation.",
  "id": "GHSA-rjg6-39jm-rgg4",
  "modified": "2026-07-24T15:40:54Z",
  "published": "2026-07-24T15:40:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/pull/10242"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/commit/7c126dcd1aad24468ec37e876545c1d083d8acca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/better-auth/better-auth"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/releases/tag/v1.6.22"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@better-auth/scim: account takeover and stale access via SCIM provider-id collision"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-5182"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-26T11:15:24Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unknown code of the component Listing Handler. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component.",
  "id": "GHSA-rjv6-gj2v-mh9h",
  "modified": "2025-05-26T12:30:30Z",
  "published": "2025-05-26T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5182"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS"
    },
    {
      "type": "WEB",
      "url": "https://summerpearlgroup.gr/spgpm/releases"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.310270"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.310270"
    },
    {
      "type": "WEB",
      "url": "https://www.youtube.com/watch?v=0wwuatTa6sU"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-6317"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T14:15:07Z",
    "severity": "HIGH"
  },
  "details": "A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN.\u00a0\n\nFull versions and TV models affected:\n\nwebOS 4.9.7 - 5.30.40 running on LG43UM7000PLA \nwebOS 5.5.0 - 04.50.51 running on OLED55CXPUA \nwebOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB \u00a0\nwebOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA",
  "id": "GHSA-rm4x-93m8-4qcv",
  "modified": "2025-02-07T21:30:51Z",
  "published": "2024-04-09T15:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6317"
    },
    {
      "type": "WEB",
      "url": "https://bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos"
    },
    {
      "type": "WEB",
      "url": "https://lgsecurity.lge.com/bulletins/tv#updateDetails"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "krayin/laravel-crm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-38530"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T01:31:36Z",
    "nvd_published_at": "2026-04-14T16:16:43Z",
    "severity": "HIGH"
  },
  "details": "A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.",
  "id": "GHSA-rm5f-3c25-p4cw",
  "modified": "2026-04-16T01:31:36Z",
  "published": "2026-04-14T18:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38530"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38530"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/krayin/laravel-crm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "poweradmin/poweradmin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.9.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "poweradmin/poweradmin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "poweradmin/poweradmin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.3.0"
            },
            {
              "fixed": "4.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:55:15Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Affected software\n\n- Product: Poweradmin (web front-end for PowerDNS)\n- Version tested: master, commit 7f28c3a97 (also reachable in the 4.x release line \u2014 the record-edit code is the same)\n- Component: record editing (web UI)\n- Vulnerability type: Broken Access Control / Insecure Direct Object Reference\n\n## Severity\n\nAny authenticated user who owns at least one zone can tamper with records in every other zone on the server. In a shared/multi-tenant Poweradmin install this is effectively a cross-tenant DNS takeover.\n\n## Summary\n\nWhen you save a record edit, Poweradmin checks whether you\u0027re allowed to touch the record by looking at a zone id you send in the POST body, but it then applies the change to a record id you also send in the POST body. Nothing checks that the record id actually belongs to that zone id. So you point the permission check at a zone you legitimately own, point the record id at somebody else\u0027s record, and the update goes through.\n\nA low-privilege \"Editor\" who only owns `attacker.example` was able to overwrite a record living in `victim.example` (owned by the admin), even though the same account gets a flat \"you do not have permission to access this zone\" if it tries to open that zone directly.\n\n## Where the bug is\n\nThe core mistake is in `RecordManager::editRecord()` in `lib/Domain/Service/Dns/RecordManager.php`:\n\n```php\n// line 298 \u2013 ownership is checked against the zone id from the request\n$user_is_zone_owner = UserManager::verifyUserIsOwnerZoneId($this-\u003edb, $record[\u0027zid\u0027]);\n...\n// line 346 \u2013 but the update targets the record id from the request\n$this-\u003ebackendProvider-\u003eeditRecord(\n    $record[\u0027rid\u0027], $name, $record[\u0027type\u0027], $content, $validatedTtl, $validatedPrio, $record[\u0027disabled\u0027]\n);\n```\n\n`$record[\u0027zid\u0027]` and `$record[\u0027rid\u0027]` are both taken straight from the submitted form. The permission gate uses one, the write uses the other, and they\u0027re never tied together.\n\nThe backend write has no zone scoping at all \u2014 `lib/Infrastructure/Service/SqlDnsBackendProvider.php` line 235:\n\n```php\n$stmt = $this-\u003edb-\u003eprepare(\n    \"UPDATE $recordsTable SET name = ?, type = ?, content = ?, ttl = ?, prio = ?, disabled = ? WHERE id = ?\"\n);\n$stmt-\u003eexecute([$name, $type, $content, $ttl, $prio, $disabled, $recordId]);\n```\n\nIt\u0027s `WHERE id = ?` on the record id and nothing else, so any record in the database is fair game.\n\nThe validation layer doesn\u0027t save it either. `DnsRecordValidationService::validateRecord()` (`lib/Domain/Service/DnsRecordValidationService.php`, around line 97) uses the zone id only to look up the zone name for hostname validation. It never verifies the record id lives in that zone.\n\nThere are two request paths that reach this same sink:\n\n1. Multi-record save \u2014 `EditController::saveRecords()` (`lib/Application/Controller/EditController.php`, ~line 571) loops over `$_POST[\u0027record\u0027]` and hands each entry\u0027s `rid`/`zid` to `editRecord()` verbatim. The controller\u0027s `run()` only permission-checks the zone id in the URL (~line 204), not the zone id inside each record row.\n2. Single-record save \u2014 `EditRecordController::saveRecord()` reads `$_POST[\u0027rid\u0027]` and forwards the whole `$_POST` (including the attacker-chosen `zid`) into `editRecord()`.\n\nFor comparison, the delete path does it correctly. `DeleteRecordController` (~line 101) derives the zone id from the record id on the server side with `getZoneIdFromRecordId()` and checks permission against that. `EditCommentController` also uses the URL zone id for both the check and the write. So this really is an oversight in the edit path, not a deliberate design choice \u2014 the safe pattern already exists elsewhere in the same codebase.\n\n## Proof of concept\n\nSetup (two accounts, two zones):\n\n- `attacker` \u2014 a normal user on the \"Editor\" permission template (`zone_content_edit_own_as_client`, i.e. can only edit records in zones it owns). Owns `attacker.example`, which is zone/domain id 3.\n- `admin` \u2014 owns `victim.example`, which is zone/domain id 2. That zone contains the record `www.victim.example  A  1.1.1.1` with record id 5.\n\nSteps:\n\n1. Log in as `attacker`. Confirm the access control is actually there: browse to `/zones/2/edit` (victim.example). You get \"You do not have permission to access this zone.\" Good \u2014 you genuinely can\u0027t edit that zone the normal way.\n\n2. Open your own zone\u0027s edit page, `/zones/3/edit`, and start a save (change any field and submit) with your intercepting proxy on. Catch the `POST /zones/3/edit` request. It already carries a valid CSRF `_token` and a valid `serial` for your zone, so don\u0027t touch those.\n\n3. Edit the record block in that request so it targets the victim\u0027s record while keeping your own zone id:\n\n```\nPOST /zones/3/edit HTTP/1.1\nHost: localhost:8080\nCookie: PHPSESSID=\u003cyour attacker session\u003e\nContent-Type: application/x-www-form-urlencoded\n\n_token=\u003cthe valid token from step 2\u003e\u0026serial=\u003cthe valid serial from step 2\u003e\u0026commit=1\n\u0026record[5][rid]=5\u0026record[5][zid]=3\n\u0026record[5][name]=pwned\u0026record[5][type]=A\u0026record[5][content]=6.6.6.6\n\u0026record[5][ttl]=3600\u0026record[5][prio]=0\n```\n\nThe important part: `record[5][rid]=5` is the victim\u0027s record (in zone 2), and `record[5][zid]=3` is your own zone (so the ownership check passes).\n\n4. Send it. You get HTTP 200.\n\n5. Check the result. Record 5, which lives in the admin\u0027s zone, is now overwritten:\n\n```\nsqlite\u003e SELECT id, domain_id, name, type, content FROM records WHERE id = 5;\n5|2|pwned.attacker.example|A|6.6.6.6\n```\n\n\u003cimg width=\"3363\" height=\"1311\" alt=\"Screenshot 2026-07-06 162351\" src=\"https://github.com/user-attachments/assets/a2013e3b-0993-42ac-9402-7933e6d9331f\" /\u003e\n\n\nIt\u0027s still `domain_id = 2` (the victim\u0027s zone) but its content is now attacker-controlled. You changed a record in a zone you were explicitly denied access to in step 1.\n\nTwo practical notes if you\u0027re reproducing this:\n\n- The `serial` field is Poweradmin\u0027s optimistic-lock. It\u0027s checked against **your own** zone\u0027s current SOA serial and it bumps by one after every successful save, so grab a fresh one each time (the intercept-and-modify approach in step 2 handles this for you automatically).\n- Record ids are sequential integers, so in a real attack you\u0027d just walk `rid = 1, 2, 3, \u2026` to hit every record in every zone on the box.\n\n## Impact\n\nWith one owned zone, an attacker can rewrite `content`, `type`, `ttl` and the `disabled` flag of any record anywhere in the installation. Concretely that means:\n\n- Repointing or corrupting other customers\u0027 / other departments\u0027 DNS records (integrity).\n- Silently disabling records by setting `disabled = 1` (availability).\n- A clean, resolvable hijack (victim\u0027s name kept intact) when the attacker owns a parent/ancestor zone of the target name \u2014 `HostnameValidator::normalizeRecordName` leaves the name alone if it already ends in the attacker\u0027s zone suffix, which is exactly the case in delegated-subzone setups (attacker owns `example.com`, victim owns delegated `sub.example.com`).\n\nIn the plain sibling-zone case the edited record\u0027s name gets forced under the attacker\u0027s zone suffix, which still destroys the original record \u2014 so at minimum it\u0027s cross-zone record deletion, and at most it\u0027s full record hijack.\n\nThe attacker\u0027s own CSRF token and own zone serial satisfy every form-level check, so nothing about the request looks abnormal to the app.\n\n## Suggested fix\n\nStop trusting the `zid` in the request. In `RecordManager::editRecord()` (and the `EditRecordController` path), look the zone up from the record id on the server side and use that for both the ownership check and the hostname normalization \u2014 the same thing `deleteRecord()` already does:\n\n```php\n$details = $recordRepository-\u003egetRecordDetailsFromRecordId($record[\u0027rid\u0027]);\nif ($details === null) {\n    // record doesn\u0027t exist \u2013 reject\n    return false;\n}\n$realZid = $details[\u0027zid\u0027];\n// use $realZid for verifyUserIsOwnerZoneId() and for zone-name normalization\n```\n\nReject the edit if the record doesn\u0027t exist, and never let the client decide which zone a record \"belongs\" to.\n\n## Disclosure\nCredit: Found by Saif Salah (https://saifsalah.github.io/)\nFound during a security review of Poweradmin.",
  "id": "GHSA-rm67-g9ch-vxff",
  "modified": "2026-07-24T21:55:15Z",
  "published": "2026-07-24T21:55:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/poweradmin/poweradmin/security/advisories/GHSA-rm67-g9ch-vxff"
    },
    {
      "type": "WEB",
      "url": "https://github.com/poweradmin/poweradmin/commit/12651facf49a6d9ebeb38f01e65f4aa5bfbc4da0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/poweradmin/poweradmin/commit/88f443d0bde9812ff8d00c094882c8b8e7303c49"
    },
    {
      "type": "WEB",
      "url": "https://github.com/poweradmin/poweradmin/commit/e021067157491ea70b8e333dc3f6a1ddf7e8e746"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/poweradmin/poweradmin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/poweradmin/poweradmin/releases/tag/v3.9.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/poweradmin/poweradmin/releases/tag/v4.2.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/poweradmin/poweradmin/releases/tag/v4.3.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-34000"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-14T08:15:09Z",
    "severity": "HIGH"
  },
  "details": "Unauth. IDOR vulnerability leading to PII Disclosure in\u00a0WooCommerce Stripe Payment Gateway plugin \u003c= 7.4.0 versions.",
  "id": "GHSA-rmc6-47cp-m9gj",
  "modified": "2024-04-04T04:49:39Z",
  "published": "2023-06-14T09:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34000"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/articles/unauthenticated-idor-to-pii-disclosure-vulnerability-in-woocommerce-stripe-gateway-plugin?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/woocommerce-gateway-stripe/wordpress-woocommerce-stripe-payment-gateway-plugin-7-4-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}