cve.bz

CWE-639: Authorization Bypass Through User-Controlled Key, page 10

Filter

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

What the weakness is: CWE-639 at MITRE

Ask an AI about CWE-639

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-639: Authorization Bypass Through User-Controlled Key and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/639.html and https://cve.bz/cve/cwe/639?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.5CVE-2026-104971EPSS 0.3%

    Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and th…

  2. 4.9CVE-2026-78412EPSS 0.2%

    Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in on…

  3. 6.5CVE-2026-104969EPSS 0.3%

    Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any…

  4. 5.4CVE-2026-104967EPSS 0.2%

    Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs bel…

  5. 8.7CVE-2026-104966EPSS 0.2%

    Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates…

  6. 5.4CVE-2026-104965EPSS 0.2%

    Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations …

  7. 6.8CVE-2026-104964EPSS 0.3%

    Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that w…

  8. 6.5CVE-2026-104960EPSS 0.3%

    Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint for project-bound FileAsset objects without enforcing access t…

  9. 4.3CVE-2026-104894EPSS 0.2%

    Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspa…

  10. 8.7CVE-2026-102775EPSS 0.4%

    Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download to…

  11. 5.4CVE-2026-103079EPSS 0.2%

    Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.

  12. 4.3CVE-2026-103078EPSS 0.2%

    Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.

  13. 5.3CVE-2026-84169EPSS 0.2%

    The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary ord…

  14. 5.9CVE-2026-78371EPSS 0.2%

    The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to…

  15. 2.1CVE-2026-105171EPSS 0.2%

    A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file …

  16. 5.3CVE-2026-104118EPSS 0.2%

    The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitra…

  17. 2.1CVE-2026-105097EPSS 0.3%

    A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization byp…

  18. 2.1CVE-2026-105096EPSS 0.3%

    A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypas…

  19. 8.8CVE-2026-96451EPSS 0.4%

    Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

  20. 4.3CVE-2026-11399EPSS 0.2%

    The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key…

  21. 5.3CVE-2026-105029EPSS 0.2%

    UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can su…

  22. 5.4CVE-2026-39444EPSS 0.2%

    Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a thr…

  23. 8.3CVE-2026-104449EPSS 0.3%

    YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submi…

  24. 7.1CVE-2026-104444EPSS 0.3%

    YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag fie…

  25. 5.3CVE-2026-94405EPSS 0.2%

    Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71.

  26. 4.3CVE-2026-94180EPSS 0.2%

    Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This issue affects Advanced Ads: from n/a through 2.0.26.

  27. 5.3CVE-2026-104403EPSS 0.2%

    Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9.

  28. 5.3CVE-2026-94432EPSS 0.3%

    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_order…

  29. 9.1CVE-2026-51879EPSS 0.4%

    deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tu…

  30. 6.5CVE-2026-97269EPSS 0.2%

    Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.

  31. 6.5CVE-2026-97251EPSS 0.2%

    Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.

  32. 7.5CVE-2026-100517EPSS 0.3%

    Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Reviews for WooCo…

  33. 7.5CVE-2026-100514EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.

  34. 5.3CVE-2026-62061EPSS 0.2%

    Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid…

  35. 4.3CVE-2026-102382EPSS 0.2%

    Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.

  36. 7.1CVE-2026-103288EPSS 0.2%

    Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they …

  37. 7.1CVE-2026-103252EPSS 0.3%

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. At…

  38. 5.8CVE-2026-103247EPSS 0.2%

    n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matchi…

  39. 8.3CVE-2026-103246EPSS 0.3%

    n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker…

  40. 7.1CVE-2026-64948EPSS 0.2%

    Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.

  41. 5.4CVE-2026-103496EPSS 0.1%

    In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

  42. 6.5CVE-2026-103491EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

  43. 7.5CVE-2026-93882EPSS 0.4%

    The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::render_material_items()…

  44. 5.3CVE-2026-96173EPSS 0.2%

    The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an …

  45. 6.5CVE-2026-91109EPSS 0.3%

    The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_group' parameter due to missing validation on a user controlled key. …

  46. 6.5CVE-2026-102139EPSS 0.4%

    An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature…

  47. 4.6CVE-2026-102107EPSS 0.2%

    Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was author…

  48. 6.9CVE-2026-103476EPSS 0.3%

    yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identi…

  49. 7.4CVE-2026-103446EPSS 0.3%

    Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

  50. 2.1CVE-2026-103233EPSS 0.2%

    A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation o…