CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4780 vulnerabilities reference this CWE, most recent first.
GHSA-PVH2-45C7-FQ5C
Vulnerability from github – Published: 2026-09-07 15:33 – Updated: 2026-09-07 15:33The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
{
"affected": [],
"aliases": [
"CVE-2026-4945"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-07T13:20:22Z",
"severity": "MODERATE"
},
"details": "The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the \u0027watch_checkout\u0027 function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.",
"id": "GHSA-pvh2-45c7-fq5c",
"modified": "2026-09-07T15:33:51Z",
"published": "2026-09-07T15:33:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4945"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L234"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/plugins/class-stripe-api.php#L304"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/otter-blocks/trunk/inc/render/class-stripe-checkout-block.php#L69"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3496611"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecb9f61-68d5-4c70-8d7d-e4fb067fcff9?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PVMQ-85F5-2WF6
Vulnerability from github – Published: 2025-05-07 03:30 – Updated: 2025-05-07 03:30The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.
{
"affected": [],
"aliases": [
"CVE-2025-3853"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-07T03:15:18Z",
"severity": "MODERATE"
},
"details": "The WPshop 2 \u2013 E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create valid API keys on behalf of other users.",
"id": "GHSA-pvmq-85f5-2wf6",
"modified": "2025-05-07T03:30:28Z",
"published": "2025-05-07T03:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3853"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wpshop/tags/2.6.0/modules/api/action/class-api-action.php#L160"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/136d63c4-c985-413f-8d8b-b57e11d1d230?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PVQH-8QGJ-X6QM
Vulnerability from github – Published: 2024-04-18 12:30 – Updated: 2024-04-18 12:30The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.
{
"affected": [],
"aliases": [
"CVE-2023-6897"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-18T11:15:37Z",
"severity": "MODERATE"
},
"details": "The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the \u0027alg_wc_ean_product_meta\u0027 shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.",
"id": "GHSA-pvqh-8qgj-x6qm",
"modified": "2024-04-18T12:30:31Z",
"published": "2024-04-18T12:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6897"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3070991/ean-for-woocommerce"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17b20df5-4adf-47ce-bddf-2ec0b9499de8?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PVV6-3X6H-W6V5
Vulnerability from github – Published: 2026-09-15 09:30 – Updated: 2026-09-15 09:30The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.
{
"affected": [],
"aliases": [
"CVE-2026-89141"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T07:16:31Z",
"severity": "MODERATE"
},
"details": "The AI Engine \u2013 The Chatbot, AI Framework \u0026 MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the \u0027mediaId\u0027 parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.",
"id": "GHSA-pvv6-3x6h-w6v5",
"modified": "2026-09-15T09:30:31Z",
"published": "2026-09-15T09:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89141"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.7.7/classes/api.php#L1168"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.7.7/classes/api.php#L637"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.7.7/classes/api.php#L663"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.7.7/classes/core.php#L253"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3693379"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb2ad5d-aa92-4186-aaae-45dde4a52f30?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PW3M-2XRJ-4FQ6
Vulnerability from github – Published: 2026-09-19 09:32 – Updated: 2026-09-19 15:31The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.
{
"affected": [],
"aliases": [
"CVE-2026-92421"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-19T07:16:34Z",
"severity": "MODERATE"
},
"details": "The Hydra Booking \u2014 Appointment Scheduling \u0026 Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking \u2014 Appointment Scheduling \u0026 Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts\u0027 profile data and reassign ownership of another host\u0027s record to themselves.",
"id": "GHSA-pw3m-2xrj-4fq6",
"modified": "2026-09-19T15:31:22Z",
"published": "2026-09-19T09:32:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92421"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/3ba305b9-5f3b-47eb-a5d7-ddbeeeefd0a4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PW86-QVX9-34R7
Vulnerability from github – Published: 2025-09-30 21:31 – Updated: 2025-12-17 00:00Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users to from one virtual instance to view the audit events from a different virtual instance via the _com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId parameter.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay:com.liferay.portal.security.audit.web"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.1"
},
{
"fixed": "5.0.33"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay:com.liferay.portal.security.audit.storage.service"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.4"
},
{
"fixed": "6.0.41"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-43827"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-01T15:56:54Z",
"nvd_published_at": "2025-09-30T19:15:37Z",
"severity": "MODERATE"
},
"details": "Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users to from one virtual instance to view the audit events from a different virtual instance via the `_com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId` parameter.",
"id": "GHSA-pw86-qvx9-34r7",
"modified": "2025-12-17T00:00:18Z",
"published": "2025-09-30T21:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43827"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/a14427e2338477001f86a9e65fdddb843c319818"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/d85c2f24397dcb7d9e51e7bd292dd29268efb132"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/f99602a23ce1b3aa12b2625441cfaa17bfbd22b6"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.atlassian.net/browse/LPE-17938"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43827"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Liferay Portal Vulnerable to IDOR via audit events"
}
GHSA-PW89-GXGV-MJVM
Vulnerability from github – Published: 2023-01-26 21:30 – Updated: 2023-02-02 18:30Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
{
"affected": [],
"aliases": [
"CVE-2021-36539"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-26T21:15:00Z",
"severity": "MODERATE"
},
"details": "Instructure Canvas LMS didn\u0027t properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).",
"id": "GHSA-pw89-gxgv-mjvm",
"modified": "2023-02-02T18:30:30Z",
"published": "2023-01-26T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36539"
},
{
"type": "WEB",
"url": "https://github.com/instructure/canvas-lms/issues/1905"
},
{
"type": "WEB",
"url": "https://github.com/gaukas/instructure-canvas-file-oracle"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PWQ8-2W9X-RH69
Vulnerability from github – Published: 2026-09-12 06:31 – Updated: 2026-09-12 18:30The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.
{
"affected": [],
"aliases": [
"CVE-2026-82851"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-12T06:16:26Z",
"severity": "LOW"
},
"details": "The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors\u0027 private and draft courses.",
"id": "GHSA-pwq8-2w9x-rh69",
"modified": "2026-09-12T18:30:21Z",
"published": "2026-09-12T06:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82851"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/07664081-72c3-4f7e-9324-e0047b6e6d22"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PWRF-Q7H8-JJR7
Vulnerability from github – Published: 2019-11-08 20:06 – Updated: 2021-05-10 17:22In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bagisto/bagisto"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-16403"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2019-09-25T12:47:46Z",
"nvd_published_at": "2019-09-18T12:15:00Z",
"severity": "MODERATE"
},
"details": "In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.",
"id": "GHSA-pwrf-q7h8-jjr7",
"modified": "2021-05-10T17:22:09Z",
"published": "2019-11-08T20:06:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16403"
},
{
"type": "WEB",
"url": "https://github.com/bagisto/bagisto/issues/749"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Authorization Bypass Through User-Controlled Key in Bagisto"
}
GHSA-PWW3-X2G7-X8Q2
Vulnerability from github – Published: 2024-04-12 00:30 – Updated: 2024-04-12 21:26An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "reportico-web/reportico"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-48865"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-12T21:26:13Z",
"nvd_published_at": "2024-04-11T22:15:13Z",
"severity": "MODERATE"
},
"details": "An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL.",
"id": "GHSA-pww3-x2g7-x8q2",
"modified": "2024-04-12T21:26:13Z",
"published": "2024-04-12T00:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48865"
},
{
"type": "WEB",
"url": "https://github.com/reportico-web/reportico/issues/51"
},
{
"type": "WEB",
"url": "https://gist.github.com/aashiqahamedn/39383cfbc639cbdc3e1a7d74b977aeae"
},
{
"type": "PACKAGE",
"url": "https://github.com/reportico-web/reportico"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Reportico affected by Incorrect Access Control"
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.