cve.bz

CWE-639: Authorization Bypass Through User-Controlled Key, page 30

Filter

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

What the weakness is: CWE-639 at MITRE

Ask an AI about CWE-639

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-639: Authorization Bypass Through User-Controlled Key and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/639.html and https://cve.bz/cve/cwe/639?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-53903EPSS 0.4%

    MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validate whether an authenticated user is auth…

  2. 4.3CVE-2026-10096EPSS 0.3%

    The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter due to missing validation on a user controlled key. This makes it possible for aut…

  3. 4.3CVE-2026-12904EPSS 0.5%

    The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.7.7. This is due to a mismatch between the object used for authorizati…

  4. 6.5CVE-2026-11988EPSS 0.5%

    The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.9.1 via the 'userId' parameter due to missing validat…

  5. 8.7CVE-2026-56230EPSS 0.5%

    Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant…

  6. 7.1CVE-2026-58447EPSS 0.3%

    Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video ind…

  7. 9.6CVE-2026-10140EPSS 0.4%

    IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to …

  8. 4.3CVE-2026-27956EPSS 0.3%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/servers/{server_uuid}/domains?uuid={app_uuid}` bypasses team scoping when the optional uuid query par…

  9. 5.0CVE-2026-27883EPSS 0.3%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/v1/deployments/{uuid}` endpoint allows any authenticated user to access deployment details belonging…

  10. 5.0CVE-2026-27881EPSS 0.3%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/deployments/{uuid}` in DeployController.php retrieves deployment details without validating that the …

  11. 4.3CVE-2026-14209EPSS 0.4%

    A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to…

  12. 9.8CVE-2026-12073EPSS 0.5%

    The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` …

  13. 7.7CVE-2026-34592EPSS 0.3%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups are not scoped to the current team, allowing any authenticated user to access s…

  14. 9.6CVE-2026-57498EPSS 0.3%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any oper…

  15. 6.1CVE-2026-57956EPSS 0.4%

    SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organizat…

  16. 5.3CVE-2026-57945EPSS 0.3%

    PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit t…

  17. 6.0CVE-2026-57943EPSS 0.3%

    LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation…

  18. 6.9CVE-2026-56781EPSS 0.4%

    Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records en…

  19. 7.7CVE-2026-56780EPSS 0.5%

    Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can…

  20. 6.5CVE-2026-57341EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 versions.

  21. 4.3CVE-2026-57676EPSS 0.3%

    Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9.

  22. 2.1CVE-2026-13549EPSS 0.5%

    A security flaw has been discovered in CodeAstro Complaint Management System 1.0. The affected element is the function deletereport of the file application/controllers/Report.php of the component Report Endpoint. The manipulation results i…

  23. 1.3CVE-2026-13534EPSS 0.3%

    A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7. This affects the function sha256 of the file src/main/services/memory/MemoryService.ts of the component CherryIN Preload API. Performing a manipulation of the argument sta…

  24. 2.1CVE-2026-13512EPSS 0.4%

    A vulnerability was identified in Databend up to 1.2.881 on HTTP. This affects the function ClientSessionManager::state_key of the file src/query/service/src/servers/http/v1/session/client_session_manager.rs of the component Tenant Handler…

  25. 6.3CVE-2026-13490EPSS 0.5%

    A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument …

  26. 4.3CVE-2026-11987EPSS 0.5%

    The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the 'id' paramete…

  27. 9.9CVE-2026-52782EPSS 0.5%

    OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" lea…

  28. 5.4CVE-2026-52779EPSS 0.2%

    OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one…

  29. 4.3CVE-2026-49355EPSS 0.3%

    OpenProject is open-source, web-based project management software. Prior to 17.4.0, `GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id` discloses private work package data from a linked work package that belongs to a private/in…

  30. 6.5CVE-2026-44736EPSS 0.4%

    OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject (title) of work packages they have no permission t…

  31. 4.3CVE-2026-44732EPSS 0.3%

    OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify existing documents. The target document is loaded with visibility checks and then …

  32. 4.3CVE-2026-44731EPSS 0.3%

    OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name, a…

  33. 5.4CVE-2026-56823EPSS 0.2%

    AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the `POST /api/integrations/webhooks/{webhook_id}/ping` endpoint fetches the target webhook by primary ke…

  34. 9.6CVE-2026-12411EPSS 0.3%

    Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security…

  35. 5.3CVE-2026-57665EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions.

  36. 5.3CVE-2026-57652EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.

  37. 5.4CVE-2026-57646EPSS 0.2%

    Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.

  38. 4.3CVE-2026-57634EPSS 0.3%

    Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.

  39. 5.3CVE-2026-57630EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.

  40. 7.5CVE-2026-56069EPSS 0.4%

    Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.

  41. 6.5CVE-2026-56048EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.

  42. 7.5CVE-2026-54839EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in Trinity Backup &#8211; Backup, Migrate, Restore, Clone &amp; Schedule Backups <= 2.0.9 versions.

  43. 7.6CVE-2026-54826EPSS 0.3%

    Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.

  44. 5.3CVE-2025-66123EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.

  45. 5.3CVE-2026-56774EPSS 0.5%

    Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remembe…

  46. 5.3CVE-2026-56772EPSS 0.3%

    NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verif…

  47. 7.2CVE-2026-54097EPSS 0.4%

    File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low-privileged authenticated user of filebrowser (with create + delete permissions …

  48. 4.6CVE-2026-9799EPSS 0.3%

    A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access …

  49. 7.7CVE-2026-9099EPSS 0.5%

    A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Gr…

  50. 6.8CVE-2026-55411EPSS 0.2%

    ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the authenticated endpoint POST /api/data-sources/decrypt returns the decrypted plainte…