cve.bz

CWE-639: Authorization Bypass Through User-Controlled Key, page 50

Filter

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

What the weakness is: CWE-639 at MITRE

Ask an AI about CWE-639

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-639: Authorization Bypass Through User-Controlled Key and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/639.html and https://cve.bz/cve/cwe/639?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.9CVE-2025-30257EPSS 0.3%

    Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.

  2. 6.9CVE-2025-27929EPSS 0.3%

    Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.

  3. 6.9CVE-2025-27927EPSS 0.3%

    An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.

  4. 6.9CVE-2025-27719EPSS 0.6%

    Unauthenticated attackers can query an API endpoint and get device details.

  5. 6.9CVE-2025-27575EPSS 0.3%

    An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.

  6. 6.9CVE-2025-27565EPSS 0.3%

    An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.

  7. 6.9CVE-2025-27561EPSS 0.3%

    Unauthenticated attackers can rename "rooms" of arbitrary users.

  8. 6.9CVE-2025-26857EPSS 0.3%

    Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).

  9. 6.9CVE-2025-25276EPSS 0.3%

    An unauthenticated attacker can hijack other users' devices and potentially control them.

  10. 6.9CVE-2025-24850EPSS 0.4%

    An attacker can export other users' plant information.

  11. 6.9CVE-2025-24315EPSS 0.6%

    Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).

  12. 6.9CVE-2025-31949EPSS 0.3%

    An authenticated attacker can obtain any plant name by knowing the plant ID.

  13. 6.9CVE-2025-31941EPSS 0.3%

    An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.

  14. 6.9CVE-2025-31933EPSS 0.3%

    An unauthenticated attacker can check the existence of usernames in the system by querying an API.

  15. 6.9CVE-2025-31357EPSS 0.3%

    An unauthenticated attacker can obtain a user's plant list by knowing the username.

  16. 6.9CVE-2025-30514EPSS 0.5%

    Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").

  17. 6.9CVE-2025-30254EPSS 0.5%

    An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.

  18. 6.9CVE-2025-27939EPSS 0.9%

    An attacker can change registered email addresses of other users and take over arbitrary accounts.

  19. 6.9CVE-2025-27938EPSS 0.5%

    Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").

  20. 6.9CVE-2025-27568EPSS 0.5%

    An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.

  21. 6.9CVE-2025-24487EPSS 0.5%

    An unauthenticated attacker can infer the existence of usernames in the system by querying an API.

  22. 8.7CVE-2025-3575EPSS 0.5%

    Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint.

  23. 8.7CVE-2025-3574EPSS 0.5%

    Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/obtenerFamiliaUsuario" endpoint.

  24. 6.9CVE-2025-3537EPSS 0.7%

    A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/update-user.php. The manipulation of the argument ID leads to improper autho…

  25. 6.9CVE-2025-3536EPSS 0.7%

    A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete-user.php. The manipulation of the argument ID leads to…

  26. 4.3CVE-2025-3292EPSS 0.3%

    The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update…

  27. 5.3CVE-2025-3282EPSS 0.3%

    The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_member…

  28. 6.5CVE-2025-32373EPSS 0.4%

    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not …

  29. 8.8CVE-2025-2526EPSS 0.6%

    The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details li…

  30. 7.5CVE-2025-22931EPSS 0.5%

    An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members.

  31. 5.4CVE-2025-31867EPSS 0.4%

    Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.

  32. 4.9CVE-2025-31833EPSS 0.6%

    Authorization Bypass Through User-Controlled Key vulnerability in themeglow JobBoard Job listing job-board-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoard Job listing: from n/a thro…

  33. 4.3CVE-2025-30777EPSS 0.5%

    Authorization Bypass Through User-Controlled Key vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.1…

  34. 5.3CVE-2024-13558EPSS 0.4%

    The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due to missing validation on a user controlled key. This makes it possible for unauth…

  35. 6.5CVE-2024-9617ExploitEPSS 1.7%

    An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_…

  36. 8.8CVE-2024-8613EPSS 0.6%

    A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240802 allows attackers to access, copy, and delete other users' chat histories. This issue arises due to improper handling of session data and lack of access control mechanisms, enab…

  37. 4.3CVE-2024-7476EPSS 1.5%

    A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{i…

  38. 6.5CVE-2024-12880EPSS 0.7%

    A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. The issue arises from the way tenant IDs are handled in the application. If a user has access to multiple tenants,…

  39. 8.8CVE-2024-12048EPSS 0.7%

    An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete …

  40. 6.5CVE-2024-11300EPSS 0.7%

    In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can access prompt data of another user. This issue affects version 1.6.2 and the main branch. The vulnerability allows unauthorized user…

  41. 5.3CVE-2024-11167EPSS 0.6%

    An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether t…

  42. 7.5CVE-2024-11137EPSS 0.6%

    An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of lunary-ai/lunary version 1.6.0. This vulnerability allows an attacker to update the score data of any run by manipulating the id …

  43. 6.5CVE-2024-10366EPSS 0.4%

    An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowi…

  44. 4.3CVE-2025-1667EPSS 0.4%

    The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTeacher() function in all versions up to, and including, 2.2.16. This makes it poss…

  45. 6.5CVE-2024-13407EPSS 0.3%

    The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via the megamenu block due to insufficient restrictions on which posts can be included. This makes it possible for authent…

  46. 9.8CVE-2024-11285EPSS 0.4%

    The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. This is due to the plugin not properly validating a user's identity prior to updating their details l…

  47. 9.8CVE-2024-11284EPSS 0.5%

    The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. This is due to the plugin not properly validating a user's identity prior to updating their password …

  48. 8.8CVE-2024-53406EPSS 0.6%

    Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the session key from a previous connection session, creating an opportunity for attackers to ex…

  49. 7.7CVE-2025-2271EPSS 0.3%

    A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit results of other users by exploiting an Insecure Direct Object Reference (IDOR) vulnerability in the Issuetrak audit component. The vul…

  50. 5.3CVE-2024-13887EPSS 0.3%

    The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.14 via the 'ajax_listing_submit_image_upload' function …