cve.bz

CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key

Filter

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

What the weakness is: CWE-566 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Ask an AI about CWE-566

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/566.html and https://cve.bz/cve/cwe/566?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2026-85749EPSS 0.3%

    MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail o…

  2. 8.8CVE-2026-84650EPSS 0.5%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, t…

  3. 8.1CVE-2026-21886EPSS 0.2%

    OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity ob…

  4. 9.8CVE-2025-9953EPSS 0.4%

    Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection. This issue affects Databank Accreditation Software: before 2026…

  5. 9.1CVE-2025-61781EPSS 0.2%

    OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as d…

  6. 3.8CVE-2025-56556EPSS 0.2%

    An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel - to gain escalated privileges in the context of the SQL quer…

  7. 2.7CVE-2025-30369EPSS 0.3%

    Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same orga…

  8. 2.7CVE-2025-30368EPSS 0.3%

    Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as th…

  9. 5.5CVE-2024-22261EPSS 0.4%

    SQL-Injection in Harbor allows priviledge users to leak the task IDs

  10. 9.1CVE-2014-0808EPSS 2.2%

    Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain ot…