CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4719 vulnerabilities reference this CWE, most recent first.
GHSA-R59X-8XCR-CC6W
Vulnerability from github – Published: 2023-11-14 06:30 – Updated: 2026-08-28 18:30Insecure Direct Object References (IDOR) in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters.
{
"affected": [],
"aliases": [
"CVE-2023-43900"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-14T05:15:08Z",
"severity": "MODERATE"
},
"details": "Insecure Direct Object References (IDOR) in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters.",
"id": "GHSA-r59x-8xcr-cc6w",
"modified": "2026-08-28T18:30:25Z",
"published": "2023-11-14T06:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43900"
},
{
"type": "WEB",
"url": "https://secpro.co/blog/cve-2023-43900"
},
{
"type": "WEB",
"url": "https://secpro.llc/emsigner-cve-3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R5C3-XJH9-7VCW
Vulnerability from github – Published: 2025-12-23 21:30 – Updated: 2025-12-23 21:30Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized access to another user's account.
{
"affected": [],
"aliases": [
"CVE-2021-47721"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-23T20:15:44Z",
"severity": "HIGH"
},
"details": "Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim\u0027s unique ID from the page source and replace their own session cookie to gain unauthorized access to another user\u0027s account.",
"id": "GHSA-r5c3-xjh9-7vcw",
"modified": "2025-12-23T21:30:28Z",
"published": "2025-12-23T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47721"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/50551"
},
{
"type": "WEB",
"url": "https://www.orangescrum.org"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/orangescrum-authenticated-privilege-escalation-via-user-session-manipulation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-R5F6-FC86-75RH
Vulnerability from github – Published: 2026-09-03 21:31 – Updated: 2026-09-03 21:31Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.
{
"affected": [],
"aliases": [
"CVE-2026-85392"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T19:17:30Z",
"severity": "MODERATE"
},
"details": "Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user\u0027s ID, since the endpoint performs no authorization checks to verify the caller owns the target account.",
"id": "GHSA-r5f6-fc86-75rh",
"modified": "2026-09-03T21:31:15Z",
"published": "2026-09-03T21:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85392"
},
{
"type": "WEB",
"url": "https://github.com/Peppermint-Lab/peppermint/issues/529"
},
{
"type": "WEB",
"url": "https://github.com/Peppermint-Lab/peppermint"
},
{
"type": "WEB",
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/auth.ts"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/peppermint-through-0.5.5-authorization-bypass-on-the-user-logout-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-R5JF-6F2J-GQC9
Vulnerability from github – Published: 2025-07-21 15:30 – Updated: 2026-06-05 18:31Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers.This issue affects PAVO Pay: before 13.05.2025.
{
"affected": [],
"aliases": [
"CVE-2025-4129"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-21T14:15:29Z",
"severity": "HIGH"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers.This issue affects PAVO Pay: before 13.05.2025.",
"id": "GHSA-r5jf-6f2j-gqc9",
"modified": "2026-06-05T18:31:30Z",
"published": "2025-07-21T15:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4129"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0166"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0166"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R5PQ-3CXR-5RMC
Vulnerability from github – Published: 2022-05-17 00:01 – Updated: 2022-05-25 00:00The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-1425"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-16T15:15:00Z",
"severity": "MODERATE"
},
"details": "The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.",
"id": "GHSA-r5pq-3cxr-5rmc",
"modified": "2022-05-25T00:00:36Z",
"published": "2022-05-17T00:01:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1425"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/b110e2f7-4aa3-47b5-a8f2-0a7fe53cc467"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R5VQ-MCCW-JGVP
Vulnerability from github – Published: 2026-08-24 21:33 – Updated: 2026-08-24 21:33Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.
{
"affected": [],
"aliases": [
"CVE-2026-71507"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-24T19:16:50Z",
"severity": "HIGH"
},
"details": "Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.",
"id": "GHSA-r5vq-mccw-jgvp",
"modified": "2026-08-24T21:33:43Z",
"published": "2026-08-24T21:33:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71507"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/c100564d059e19c711317c734d302a90b11e2e8b"
},
{
"type": "WEB",
"url": "https://codeant.ai/security-research/cve-2026-71507-dolibarr-bola-lets-attackers-redirect-supplier-payments"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/dolibarr-rest-api-broken-object-level-authorization-via-bank-account-routes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-R62C-GW4M-R5QJ
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality.
{
"affected": [],
"aliases": [
"CVE-2021-3380"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-10T17:15:00Z",
"severity": "MODERATE"
},
"details": "Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality.",
"id": "GHSA-r62c-gw4m-r5qj",
"modified": "2022-05-24T19:20:16Z",
"published": "2022-05-24T19:20:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3380"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/49508"
},
{
"type": "WEB",
"url": "http://height8.com"
},
{
"type": "WEB",
"url": "http://icrem.com"
},
{
"type": "WEB",
"url": "http://www.height8tech.com/carrier-grade-OSS-BSS.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R66X-PVWM-7PF5
Vulnerability from github – Published: 2025-05-16 18:31 – Updated: 2026-04-01 18:35Authorization Bypass Through User-Controlled Key vulnerability in Chimpstudio WP JobHunt allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP JobHunt: from n/a through 7.1.
{
"affected": [],
"aliases": [
"CVE-2025-39537"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-79"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-16T16:15:41Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Chimpstudio WP JobHunt allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP JobHunt: from n/a through 7.1.",
"id": "GHSA-r66x-pvwm-7pf5",
"modified": "2026-04-01T18:35:06Z",
"published": "2025-05-16T18:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39537"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/woo-better-customer-list/vulnerability/wordpress-better-customer-list-for-woocommerce-plugin-1-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-jobhunt/vulnerability/wordpress-wp-jobhunt-7-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R688-P362-J7QJ
Vulnerability from github – Published: 2024-06-29 06:31 – Updated: 2024-06-29 06:31The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to clone and read private posts.
{
"affected": [],
"aliases": [
"CVE-2024-5942"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-29T05:15:03Z",
"severity": "MODERATE"
},
"details": "The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the \u0027content_clone\u0027 function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to clone and read private posts.",
"id": "GHSA-r688-p362-j7qj",
"modified": "2024-06-29T06:31:41Z",
"published": "2024-06-29T06:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5942"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L19"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3108149"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R6X6-P549-4H98
Vulnerability from github – Published: 2024-11-09 03:30 – Updated: 2025-01-29 21:31The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'ce_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
{
"affected": [],
"aliases": [
"CVE-2024-10779"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-09T03:15:05Z",
"severity": "MODERATE"
},
"details": "The Cowidgets \u2013 Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the \u0027ce_template\u0027 shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.",
"id": "GHSA-r6x6-p549-4h98",
"modified": "2025-01-29T21:31:23Z",
"published": "2024-11-09T03:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10779"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/cowidgets-elementor-addons"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec005f9f-3f63-4d73-9bd5-dc9c4c4b8bfe?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.