cve.bz

CWE-639: Authorization Bypass Through User-Controlled Key, page 49

Filter

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

What the weakness is: CWE-639 at MITRE

Ask an AI about CWE-639

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-639: Authorization Bypass Through User-Controlled Key and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/639.html and https://cve.bz/cve/cwe/639?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.1CVE-2025-6765EPSS 0.4%

    A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to p…

  2. 5.3CVE-2025-49135EPSS 0.3%

    CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the quer…

  3. 6.5CVE-2025-50693EPSS 0.3%

    PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Insecure Direct Object Reference (IDOR) in odms/request-details.php.

  4. 7.5CVE-2025-3091EPSS 0.4%

    An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.

  5. 1.3CVE-2025-6534EPSS 0.5%

    A vulnerability, which was classified as problematic, was found in xxyopen/201206030 novel-plus up to 5.1.3. This affects the function remove of the file novel-admin/src/main/java/com/java2nb/common/controller/FileController.java of the co…

  6. 5.3CVE-2025-49995EPSS 0.4%

    Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a …

  7. 4.3CVE-2025-49978EPSS 0.4%

    Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through < 3.0.6.

  8. 2.1CVE-2025-6329EPSS 0.5%

    A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file userdelete.php of the component User Delete Handler. The manipulation of t…

  9. 4.3CVE-2025-5195EPSS 0.3%

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. It was possible for authenticated users to access arbitrary compliance frameworks, leading to unaut…

  10. 4.3CVE-2024-45329EPSS 0.3%

    A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may allow an authenticated attacker to view unauthorized device information via key m…

  11. 6.9CVE-2025-40661EPSS 0.3%

    An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/se…

  12. 6.9CVE-2025-40660EPSS 0.3%

    An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/select node/data…

  13. 6.9CVE-2025-40659EPSS 0.3%

    An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/fr…

  14. 6.9CVE-2025-40658EPSS 0.3%

    An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/fr…

  15. 5.3CVE-2025-4691EPSS 0.3%

    The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to miss…

  16. 8.7CVE-2025-40650EPSS 0.4%

    Insecure Direct Object Reference (IDOR) vulnerability in Clickedu. This vulnerability could allow an attacker to retrieve information about student report cards.

  17. 5.3CVE-2025-5182EPSS 0.4%

    A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unknown code of the component Listing Handler. The manipulation leads to authorizat…

  18. 5.1CVE-2025-5181EPSS 0.5%

    A vulnerability, which was classified as problematic, was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. This affects an unknown part of the file /spgpm/updateListing. The manipulation of the argument spgLsTit…

  19. 4.3CVE-2025-20114EPSS 0.4%

    A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to insufficient validatio…

  20. 3.5CVE-2024-12767EPSS 0.3%

    The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts

  21. 5.0CVE-2025-24969EPSS 0.3%

    iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any other contacts picture by changing the picture ID in the URL. Version 3.2.1 contains a patch for the issue.

  22. 6.5CVE-2024-52601EPSS 0.3%

    iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions …

  23. 5.3CVE-2025-3769EPSS 0.4%

    The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missi…

  24. 5.3CVE-2024-8988EPSS 0.3%

    The PeepSo Core: File Uploads plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.6.0 via the file_download REST API endpoint due to missing validation on a user controlled key. …

  25. 9.8CVE-2025-3605ExploitEPSS 7.7%

    The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.1. This is due to the plugin not properly validating a user's identity pri…

  26. 9.8CVE-2025-3811EPSS 0.8%

    The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details l…

  27. 9.8CVE-2025-3810EPSS 0.8%

    The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details l…

  28. 4.3CVE-2025-20214EPSS 0.3%

    A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data. This vulnerability…

  29. 6.5CVE-2025-3853EPSS 0.2%

    The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callback_generate_api_key() due to missing validation on a user controlled key. This makes it possible for …

  30. 5.3CVE-2025-3281EPSS 0.4%

    The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the create_stripe_subscripti…

  31. 8.8CVE-2025-3610EPSS 0.6%

    The Reales WP STPT plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.1.2. This is due to the plugin not properly validating a user's identity prior to updating their det…

  32. 3.3CVE-2025-47226ExploitEPSS 1.3%

    Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

  33. 6.9CVE-2025-4210ExploitEPSS 1.8%

    A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authoriza…

  34. 4.3CVE-2025-1327EPSS 0.2%

    The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missing validation on a user controlled key. This makes it possib…

  35. 5.3CVE-2025-3889EPSS 0.4%

    The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This m…

  36. 6.5CVE-2025-3874EPSS 0.4%

    The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthe…

  37. 6.9CVE-2025-4119EPSS 0.7%

    A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Product Statistics Handler. The manipulation of the argument isDelete with the input 1…

  38. 4.3CVE-2025-3640EPSS 0.4%

    A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.

  39. 4.3CVE-2025-3636EPSS 0.3%

    A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks.

  40. 7.1CVE-2025-3625EPSS 0.4%

    A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA…

  41. 8.0CVE-2025-25777EPSS 0.3%

    Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentic…

  42. 4.3CVE-2025-1284EPSS 0.3%

    The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1 via the xc_woo_printer_preview AJAX acti…

  43. 9.3CVE-2025-42605EPSS 0.5%

    This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellation operations. An authenticated remote attacker could exploit this vulnerabi…

  44. 7.0CVE-2025-3519EPSS 0.3%

    An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant …

  45. 4.3CVE-2025-39434EPSS 0.3%

    Authorization Bypass Through User-Controlled Key vulnerability in Scott Taylor Avatar avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avatar: from n/a through <= 0.1.4.

  46. 6.9CVE-2025-31950EPSS 0.3%

    An unauthenticated attacker can obtain EV charger energy consumption information of other users.

  47. 6.9CVE-2025-31945EPSS 0.6%

    An unauthenticated attacker can obtain other users' charger information.

  48. 6.9CVE-2025-31654EPSS 0.3%

    An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").

  49. 6.9CVE-2025-31360EPSS 0.5%

    Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.

  50. 6.9CVE-2025-31147EPSS 0.3%

    Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.