cve.bz

CWE-639: Authorization Bypass Through User-Controlled Key, page 11

Filter

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

What the weakness is: CWE-639 at MITRE

Ask an AI about CWE-639

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-639: Authorization Bypass Through User-Controlled Key and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/639.html and https://cve.bz/cve/cwe/639?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.9CVE-2026-100272EPSS 0.3%

    In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

  2. 2.7CVE-2026-100268EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates

  3. 5.3CVE-2026-97259EPSS 0.2%

    Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: fro…

  4. 5.3CVE-2026-97282EPSS 0.2%

    Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.

  5. 4.3CVE-2026-97079EPSS 0.3%

    Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.

  6. 5.3CVE-2026-97078EPSS 0.2%

    Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.

  7. 4.3CVE-2026-97074EPSS 0.2%

    Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

  8. 5.3CVE-2026-97066EPSS 0.2%

    Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.

  9. 6.5CVE-2026-96347EPSS 0.3%

    Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.

  10. 5.3CVE-2026-94673EPSS 0.2%

    Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

  11. 4.3CVE-2026-94672EPSS 0.2%

    Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

  12. 5.4CVE-2026-94173EPSS 0.2%

    Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.

  13. 9.2CVE-2026-74865EPSS 0.4%

    sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbit…

  14. 9.3CVE-2026-74864EPSS 0.4%

    sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any clie…

  15. 5.4CVE-2026-62081EPSS 0.2%

    Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.

  16. 8.3CVE-2026-103237EPSS 0.2%

    MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report …

  17. 8.7CVE-2026-103235EPSS 0.3%

    MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persis…

  18. 2.0CVE-2026-102844EPSS 0.3%

    A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporan_data_pasien.php. Exec…

  19. 7.1CVE-2026-103054EPSS 0.3%

    AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfol…

  20. 9.1CVE-2026-79537EPSS 0.3%

    metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session store (getSession in session-lifetime-manager.ts) is keyed only by the client-supplied mcp-session-id…

  21. 4.3CVE-2026-79348EPSS 0.2%

    KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or…

  22. 8.6CVE-2026-102876EPSS 0.3%

    SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB header…

  23. 6.9CVE-2026-90907EPSS 0.2%

    Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-leve…

  24. 6.9CVE-2026-101112EPSS 0.2%

    Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifi…

  25. 2.1CVE-2026-102261EPSS 0.3%

    A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avata…

  26. 7.1CVE-2026-97685EPSS 0.3%

    An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patchin…

  27. 7.1CVE-2026-102373EPSS 0.2%

    GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tick…

  28. 7.1CVE-2026-93538EPSS 0.2%

    A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such a…

  29. 8.1CVE-2026-82323EPSS 0.3%

    Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows Exploitation of Trusted Identifiers. This issue affects Enocta Platform: through 2026-09-28.

  30. 7.7CVE-2026-82348EPSS 0.3%

    Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based loo…

  31. 5.1CVE-2026-100897EPSS 0.2%

    A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impacted element is an unknown function of the file /StudentInfo/StudentHandler/moditypasswordstu of the component Password…

  32. 5.5CVE-2026-100885ExploitEPSS 1.4%

    A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation resul…

  33. 9.3CVE-2026-101084EPSS 0.3%

    obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks t…

  34. 2.1CVE-2026-100878EPSS 0.2%

    A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole End…

  35. 5.3CVE-2026-101033EPSS 0.2%

    KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, an…

  36. 5.3CVE-2026-92436EPSS 0.3%

    The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unaut…

  37. 3.8CVE-2026-86839EPSS 0.2%

    The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authentic…

  38. 6.3CVE-2026-72662EPSS 0.2%

    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user gran…

  39. 7.1CVE-2026-100688EPSS 0.3%

    Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source cod…

  40. 7.1CVE-2026-100679EPSS 0.4%

    stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own a…

  41. 8.7CVE-2026-100670EPSS 0.4%

    Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard that is resolved by the field's exact path, so a submitted flat d…

  42. 7.2CVE-2026-100627EPSS 0.4%

    Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which aut…

  43. 5.3CVE-2026-100626EPSS 0.2%

    capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images buc…

  44. 8.7CVE-2026-100618EPSS 0.3%

    Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image pat…

  45. 8.7CVE-2026-100614EPSS 0.4%

    Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenan…

  46. 8.6CVE-2026-100612EPSS 0.3%

    Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_prov…

  47. 7.7CVE-2026-100610EPSS 0.3%

    Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory() returns Upser…

  48. 7.6CVE-2026-100609EPSS 0.3%

    Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: …

  49. 7.2CVE-2026-100579EPSS 0.2%

    OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments (authentication modes that honor caller identity and narrower operator scopes), a write-sc…

  50. 2.3CVE-2026-100534EPSS 0.3%

    OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child sess…