CWE-639

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/pydio/cells"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-2978"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-31T18:26:17Z",
    "nvd_published_at": "2023-05-30T14:15:09Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifier assigned to this vulnerability.",
  "id": "GHSA-mv7x-27pc-8c96",
  "modified": "2023-11-02T17:22:33Z",
  "published": "2023-05-30T15:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2978"
    },
    {
      "type": "WEB",
      "url": "https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be"
    },
    {
      "type": "WEB",
      "url": "https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.230210"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.230210"
    },
    {
      "type": "PACKAGE",
      "url": "github.com/pydio/cells"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Go package pydio/cells vulnerable to authorization bypass"
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-15204"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-10-11T01:32:00Z",
    "severity": "MODERATE"
  },
  "details": "In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user.",
  "id": "GHSA-mvf5-qjmw-6p5m",
  "modified": "2022-05-13T01:43:40Z",
  "published": "2022-05-13T01:43:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15204"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kanboard/kanboard/commit/074f6c104f3e49401ef0065540338fc2d4be79f0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kanboard/kanboard/commit/3e0f14ae2b0b5a44bd038a472f17eac75f538524"
    },
    {
      "type": "WEB",
      "url": "https://kanboard.net/news/version-1.0.47"
    },
    {
      "type": "WEB",
      "url": "http://openwall.com/lists/oss-security/2017/10/04/9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-49298"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-24T19:15:07Z",
    "severity": "HIGH"
  },
  "details": "OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.",
  "id": "GHSA-mvg7-8xh2-47rf",
  "modified": "2025-11-03T21:30:56Z",
  "published": "2023-11-24T21:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49298"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openzfs/zfs/issues/15526"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openzfs/zfs/pull/15571"
    },
    {
      "type": "WEB",
      "url": "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275308"
    },
    {
      "type": "WEB",
      "url": "https://bugs.gentoo.org/917224"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.1.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.2.2"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00019.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00009.html"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=38405731"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=38770168"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20231124172959/https://www.ibm.com/support/pages/how-remove-missing%C2%A0newline%C2%A0or%C2%A0line%C2%A0too%C2%A0long-error-etchostsallow%C2%A0and%C2%A0etchostsdeny-files"
    },
    {
      "type": "WEB",
      "url": "https://www.theregister.com/2023/12/04/two_new_versions_of_openzfs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-1327"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-02T04:15:46Z",
    "severity": "MODERATE"
  },
  "details": "The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the \u0027homey_delete_user_account\u0027 action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user\u0027s accounts.",
  "id": "GHSA-mvp9-jcp7-42x3",
  "modified": "2025-05-02T06:31:24Z",
  "published": "2025-05-02T06:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1327"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/homey-booking-wordpress-theme/23338013"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38aa649c-e9d3-458b-b567-e2e751aaca00?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-32223"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-19T09:16:15Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through 3.9.4.",
  "id": "GHSA-mvxw-39vg-5jr5",
  "modified": "2026-04-01T18:36:32Z",
  "published": "2026-03-19T09:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32223"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/tutor/vulnerability/wordpress-tutor-lms-plugin-3-9-4-insecure-direct-object-references-idor-vulnerability-2?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-14212"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-26T06:16:24Z",
    "severity": "MODERATE"
  },
  "details": "The Booking for Appointments and Events Calendar  WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee\u0027s cabinet password and take over their account.",
  "id": "GHSA-mw2j-768f-6vw5",
  "modified": "2026-08-26T18:31:52Z",
  "published": "2026-08-26T18:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14212"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/5afb51cc-8e1e-4c3c-aba6-6789e89161ae"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-22931"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-03T14:15:29Z",
    "severity": "HIGH"
  },
  "details": "An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members.",
  "id": "GHSA-mw97-j6p7-xp5g",
  "modified": "2025-04-21T21:30:26Z",
  "published": "2025-04-03T15:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22931"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OS4ED/openSIS-Classic"
    },
    {
      "type": "WEB",
      "url": "https://github.com/esusalla/vulnerability-research/tree/main/CVE-2025-22931"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.123.64"
      },
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T22:02:51Z",
    "nvd_published_at": "2026-07-22T12:18:18Z",
    "severity": "HIGH"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-35q8-9mj6-wjmf. This link is maintained to preserve external references.\n\n## Original Description\nn8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, credentials, users, and instance configuration. Exploitation requires that Enterprise SSO is configured, instance-role provisioning is enabled via N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE (disabled by default), and the attacker controls the instance-role claim value issued by the IdP.",
  "id": "GHSA-mwq7-vcmc-cm4q",
  "modified": "2026-07-22T22:02:51Z",
  "published": "2026-07-22T12:32:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65016"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-sso-instance-role"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner",
  "withdrawn": "2026-07-22T22:02:51Z"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "grpc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.0"
            },
            {
              "fixed": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48599"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T18:11:15Z",
    "nvd_published_at": "2026-06-15T23:16:45Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nIn the HTTP-to-gRPC transcoding layer of the `grpc` Hex package, query-string and request-body parameters can silently overwrite path-bound fields when building the decoded protobuf request struct. An authenticated attacker who can reach a transcoded endpoint can substitute any path-bound identifier (e.g. `user_id` from `/users/{user_id}/profile`) with an arbitrary value, bypassing authorization, multi-tenancy, and ownership checks that rely on the path-derived field.\n\n### Details\n\nAll three clauses of `GRPC.Server.Transcode.map_request/5` (`grpc_server/lib/grpc/server/transcode.ex`) use `Map.merge/2` with path bindings as the first argument, giving them the lowest merge precedence. Path bindings are extracted by the router from the matched URL template and should be the authoritative resource identifiers, but query-string and body parameters overwrite them. The decoded protobuf struct handed to the handler carries the attacker\u0027s value instead of the router\u0027s.\n\n### PoC\n\n1. Deploy a transcoded gRPC service with a route like `GET /users/{user_id}/profile` where the handler authorizes access based on `request.user_id`.\n2. Send: `GET /users/me/profile?user_id=victim`\n3. The decoded request struct has `user_id = \"victim\"` \u2014 the authorization check passes for the victim\u0027s resource, not the caller\u0027s.\n4. Alternatively, for a `POST` with `body: \"*\"`: send `{\"user_id\": \"victim\"}` in the JSON body.\n\n### Impact\n\nAffects applications using `grpc` \u2265 0.8.0 with HTTP transcoding enabled that rely on path-bound fields for authorization or tenant isolation. Fixed in 1.0.0. An authenticated attacker can read or modify any other user\u0027s resources exposed via transcoded endpoints.\n\n### References\n\n* Introduction commit: https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048\n* Patch commit: https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4",
  "id": "GHSA-mwr4-5g34-j5cq",
  "modified": "2026-08-25T18:11:16Z",
  "published": "2026-08-25T18:11:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48599"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elixir-grpc/grpc/pull/541"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-48599.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/elixir-grpc/grpc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/elixir-grpc/grpc/releases/tag/v1.0.0"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48599"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "gRPC Erlang package\u0027s path bindings are overridable by query string and request body"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-93366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T18:17:33Z",
    "severity": "MODERATE"
  },
  "details": "Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints. Attackers can retrieve page UUIDs for all users via the content-get-list endpoint and then submit crafted POST requests to the list-images and delete-image endpoints in bl-kernel/ajax/ to access and destroy media files outside their own pages, bypassing the IMAGE_RESTRICT isolation control.",
  "id": "GHSA-mx48-544j-vv99",
  "modified": "2026-09-25T18:31:29Z",
  "published": "2026-09-25T18:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93366"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/akinerkisa/6a7532442795beefd29b9c55a100eb16"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/bludit-cms-authorization-bypass-via-list-images-delete-image-ajax-endpoints"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}