CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

3,447 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 45 of 69

CVE-2026-116746MEDIUMCVSS 5.3EG 5.3
2026-10-26
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly …
CVE-2026-97255MEDIUMCVSS 5.3EG 5.3
2026-10-26
Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from…
CVE-2026-100142MEDIUMCVSS 5.3EG 5.3
2026-10-22
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored addre…
CVE-2026-114392MEDIUMCVSS 5.3EG 5.3
2026-10-21
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's …
CVE-2026-111596MEDIUMCVSS 5.3EG 5.3
2026-10-21
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billin…
CVE-2026-107789MEDIUMCVSS 5.3EG 5.3
2026-10-21
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, a…
CVE-2026-114091MEDIUMCVSS 5.3EG 5.3
2026-10-21
Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendly…
CVE-2026-112068MEDIUMCVSS 5.3EG 5.3
2026-10-20
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
CVE-2026-94229MEDIUMCVSS 5.3EG 5.3
2026-10-19
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal informa…
CVE-2026-111902MEDIUMCVSS 5.3EG 5.3
2026-10-17
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language he…
CVE-2026-111707MEDIUMCVSS 5.3EG 5.3
2026-10-16
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to…
CVE-2026-111620MEDIUMCVSS 5.3EG 5.3
2026-10-16
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream n…
CVE-2026-111324MEDIUMCVSS 5.3EG 5.3
2026-10-15
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, u…
CVE-2026-110774MEDIUMCVSS 5.3EG 5.3
2026-10-14
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored fil…
CVE-2026-110764MEDIUMCVSS 5.3EG 5.3
2026-10-14
AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can en…
CVE-2026-96900MEDIUMCVSS 5.3EG 5.3
2026-10-14
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who k…
CVE-2026-94261MEDIUMCVSS 5.3EG 5.3
2026-10-14
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transac…
CVE-2026-106166MEDIUMCVSS 5.3EG 5.3
2026-10-14
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or ap…
CVE-2026-107652MEDIUMCVSS 5.3EG 5.3
2026-10-14
The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_…
CVE-2026-108862MEDIUMCVSS 5.3EG 5.3
2026-10-11
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view perm…
CVE-2026-108724MEDIUMCVSS 5.3EG 5.3
2026-10-11
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers…
CVE-2026-108596MEDIUMCVSS 5.3EG 5.3
2026-10-10
OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id…
CVE-2026-105893MEDIUMCVSS 5.3EG 5.3
2026-10-08
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.
CVE-2026-105198MEDIUMCVSS 5.3EG 5.3
2026-10-08
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retr…
CVE-2026-84169MEDIUMCVSS 5.3EG 5.3
2026-10-05
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary ord…
CVE-2026-104118MEDIUMCVSS 5.3EG 5.3
2026-10-04
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitra…
CVE-2026-104403MEDIUMCVSS 5.3EG 5.3
2026-10-02
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9.
CVE-2026-94405MEDIUMCVSS 5.3EG 5.3
2026-10-02
Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71.
CVE-2026-94432MEDIUMCVSS 5.3EG 5.3
2026-10-02
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_ord…
CVE-2026-62061MEDIUMCVSS 5.3EG 5.3
2026-10-01
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid…
CVE-2026-96173MEDIUMCVSS 5.3EG 5.3
2026-10-01
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an …
CVE-2026-103476MEDIUMCVSS 5.3EG 5.3
2026-09-30
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identi…
CVE-2026-97259MEDIUMCVSS 5.3EG 5.3
2026-09-30
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: fro…
CVE-2026-97282MEDIUMCVSS 5.3EG 5.3
2026-09-30
Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.
CVE-2026-97078MEDIUMCVSS 5.3EG 5.3
2026-09-30
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
CVE-2026-97066MEDIUMCVSS 5.3EG 5.3
2026-09-30
Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
CVE-2026-94673MEDIUMCVSS 5.3EG 5.3
2026-09-30
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
CVE-2026-101112MEDIUMCVSS 5.3EG 5.3
2026-09-29
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifi…
CVE-2026-90907MEDIUMCVSS 5.3EG 5.3
2026-09-29
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-leve…
CVE-2026-92436MEDIUMCVSS 5.3EG 5.3
2026-09-27
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unaut…
CVE-2026-84460MEDIUMCVSS 5.3EG 5.3
2026-09-25
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have ac…
CVE-2026-56728MEDIUMCVSS 5.3EG 5.3
2026-09-25
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by craft…
CVE-2026-86837MEDIUMCVSS 5.3EG 5.3
2026-09-25
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored pe…
CVE-2026-97647MEDIUMCVSS 5.3EG 5.3
2026-09-25
A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime…
CVE-2026-95592MEDIUMCVSS 5.3EG 5.3
2026-09-23
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
CVE-2026-93623MEDIUMCVSS 5.3EG 5.3
2026-09-23
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
CVE-2026-92419MEDIUMCVSS 5.3EG 5.3
2026-09-23
WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access t…
CVE-2026-76910MEDIUMCVSS 5.3EG 5.3
2026-09-22
Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the sou…
CVE-2026-95683MEDIUMCVSS 5.3EG 5.3
2026-09-22
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distri…
CVE-2026-87966MEDIUMCVSS 5.3EG 5.3
2026-09-18
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id,…

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →