CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4780 vulnerabilities reference this CWE, most recent first.
GHSA-PPX8-VP24-FWPX
Vulnerability from github – Published: 2022-04-19 00:00 – Updated: 2022-04-28 00:00An Insecure Direct Object Reference issue exists in the Tyler Odyssey platform before 17.1.20. This may allow an external party to access sensitive case records.
{
"affected": [],
"aliases": [
"CVE-2022-26665"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-18T15:15:00Z",
"severity": "HIGH"
},
"details": "An Insecure Direct Object Reference issue exists in the Tyler Odyssey platform before 17.1.20. This may allow an external party to access sensitive case records.",
"id": "GHSA-ppx8-vp24-fwpx",
"modified": "2022-04-28T00:00:57Z",
"published": "2022-04-19T00:00:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26665"
},
{
"type": "WEB",
"url": "https://news.ycombinator.com/item?id=30502117"
},
{
"type": "WEB",
"url": "https://www.calbar.ca.gov/About-Us/News/Data-Breach-Updates"
},
{
"type": "WEB",
"url": "https://www.judyrecords.com/info"
},
{
"type": "WEB",
"url": "https://www.judyrecords.com/what-happened-with-tyler-technologies"
},
{
"type": "WEB",
"url": "https://www.tylertech.com/dataharvest"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PQ3P-3XRP-HVP3
Vulnerability from github – Published: 2026-10-08 06:31 – Updated: 2026-10-08 12:34The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.
{
"affected": [],
"aliases": [
"CVE-2026-105198"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-08T06:16:40Z",
"severity": "MODERATE"
},
"details": "The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order\u0027s confirmation summary, letting an unauthenticated visitor retrieve any customer\u0027s name, contact details and order confirmation code by supplying a sequential order-item id.",
"id": "GHSA-pq3p-3xrp-hvp3",
"modified": "2026-10-08T12:34:25Z",
"published": "2026-10-08T06:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105198"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/736056ca-5825-4cb7-8775-4010efe1f7cd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PQF3-28PM-5446
Vulnerability from github – Published: 2026-01-02 03:30 – Updated: 2026-01-02 03:30The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
{
"affected": [],
"aliases": [
"CVE-2025-14998"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-02T03:15:50Z",
"severity": "CRITICAL"
},
"details": "The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user\u0027s identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s passwords, including administrators, and leverage that to gain access to their account.",
"id": "GHSA-pqf3-28pm-5446",
"modified": "2026-01-02T03:30:22Z",
"published": "2026-01-02T03:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14998"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.24/inc/modules/login-screen/signup-password.php#L24"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3429115/branda-white-labeling#file1749"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae46be82-570f-4172-9c3f-746b894b84b9?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PQVW-XCM9-69PH
Vulnerability from github – Published: 2022-11-21 12:30 – Updated: 2022-11-23 18:30The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.
{
"affected": [],
"aliases": [
"CVE-2022-1579"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-21T11:15:00Z",
"severity": "HIGH"
},
"details": "The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.",
"id": "GHSA-pqvw-xcm9-69ph",
"modified": "2022-11-23T18:30:28Z",
"published": "2022-11-21T12:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1579"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/6f3d40fa-458b-44f0-9407-763e80b29668"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PQX7-WMPC-GGM9
Vulnerability from github – Published: 2026-03-25 21:30 – Updated: 2026-03-25 21:30IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable due to Insecure Direct Object Reference (IDOR).
{
"affected": [],
"aliases": [
"CVE-2025-14974"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T21:16:24Z",
"severity": "MODERATE"
},
"details": "IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable due to Insecure Direct Object Reference (IDOR).",
"id": "GHSA-pqx7-wmpc-ggm9",
"modified": "2026-03-25T21:30:36Z",
"published": "2026-03-25T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14974"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7266723"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PR4J-5X2H-5VR8
Vulnerability from github – Published: 2026-08-14 00:32 – Updated: 2026-08-14 00:32streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.
{
"affected": [],
"aliases": [
"CVE-2026-73039"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T22:17:25Z",
"severity": "MODERATE"
},
"details": "streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users\u0027 viewing status records. Attackers can enumerate all users\u0027 watch progress, delete arbitrary viewing history, and manipulate other users\u0027 Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.",
"id": "GHSA-pr4j-5x2h-5vr8",
"modified": "2026-08-14T00:32:03Z",
"published": "2026-08-14T00:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73039"
},
{
"type": "WEB",
"url": "https://github.com/streamaserver/streama/issues/1170"
},
{
"type": "WEB",
"url": "https://github.com/streamaserver/streama/commit/1fa79534ee09e25f2473cc4787b106996008a442"
},
{
"type": "WEB",
"url": "https://github.com/streamaserver/streama"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/streama-insecure-direct-object-reference-via-viewingstatuscontroller"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PR7W-97G9-F8RW
Vulnerability from github – Published: 2026-09-11 12:33 – Updated: 2026-09-11 12:33AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.
{
"affected": [],
"aliases": [
"CVE-2026-89252"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-11T12:16:55Z",
"severity": "HIGH"
},
"details": "AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users\u0027 links. A canStream user can overwrite another user\u0027s LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.",
"id": "GHSA-pr7w-97g9-f8rw",
"modified": "2026-09-11T12:33:26Z",
"published": "2026-09-11T12:33:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m2c6-f5ww-j26v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89252"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/avideo-missing-authorization-in-addlivelink-php-livelink-update"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PRCX-3PC2-2J8X
Vulnerability from github – Published: 2026-08-29 06:30 – Updated: 2026-08-30 03:31The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other customers.
Exploitation requires the attacker to know the target subscription's identifier, which is high-entropy and not enumerable through the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5.
{
"affected": [],
"aliases": [
"CVE-2026-80311"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-29T06:17:49Z",
"severity": "MODERATE"
},
"details": "The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other customers.\n\nExploitation requires the attacker to know the target subscription\u0027s identifier, which is high-entropy and not enumerable through the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5.",
"id": "GHSA-prcx-3pc2-2j8x",
"modified": "2026-08-30T03:31:21Z",
"published": "2026-08-29T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80311"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/e1b0e815-e803-4a14-ab2a-ed860e82c782"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PV42-3QX9-M56G
Vulnerability from github – Published: 2026-06-23 15:32 – Updated: 2026-06-24 00:30OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms() method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong to the caller's realm, enabling cross-tenant permanent destruction of safety-critical and security alerts.
{
"affected": [],
"aliases": [
"CVE-2026-56784"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-23T13:16:46Z",
"severity": "HIGH"
},
"details": "OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms() method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong to the caller\u0027s realm, enabling cross-tenant permanent destruction of safety-critical and security alerts.",
"id": "GHSA-pv42-3qx9-m56g",
"modified": "2026-06-24T00:30:30Z",
"published": "2026-06-23T15:32:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56784"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openremote-cross-tenant-idor-in-bulk-alarm-deletion"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openremote-manager-cross-tenant-idor-in-bulk-alarm-deletion"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PV47-2357-X653
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-24 21:33An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter
{
"affected": [],
"aliases": [
"CVE-2026-51367"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T14:17:32Z",
"severity": "HIGH"
},
"details": "An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter",
"id": "GHSA-pv47-2357-x653",
"modified": "2026-08-24T21:33:34Z",
"published": "2026-08-19T15:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51367"
},
{
"type": "WEB",
"url": "https://blog.elmec.com/cve-2026-51367-insecure-direct-object-reference-idor-leading-to-unauthorized-data-access"
},
{
"type": "WEB",
"url": "https://www.bottinelliinformatica.it/it/vedo-suite"
},
{
"type": "WEB",
"url": "https://www.cybergon.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.