CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

3,459 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 54 of 70

CVE-2026-119652MEDIUMCVSS 4.3EG 4.3
2026-10-30
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requ…
CVE-2026-119647MEDIUMCVSS 4.3EG 4.3
2026-10-30
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-re…
CVE-2026-119646MEDIUMCVSS 4.3EG 4.3
2026-10-30
Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_…
CVE-2026-119598MEDIUMCVSS 4.3EG 4.3
2026-10-30
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment ext…
CVE-2026-119596MEDIUMCVSS 4.3EG 4.3
2026-10-30
UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playli…
CVE-2026-119555MEDIUMCVSS 4.3EG 4.3
2026-10-30
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enro…
CVE-2026-119547MEDIUMCVSS 4.3EG 4.3
2026-10-30
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user t…
CVE-2026-118947MEDIUMCVSS 4.3EG 4.3
2026-10-30
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, a…
CVE-2026-108763MEDIUMCVSS 4.3EG 4.3
2026-10-29
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or c…
CVE-2026-117605MEDIUMCVSS 4.3EG 4.3
2026-10-28
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. A…
CVE-2026-16307MEDIUMCVSS 4.3EG 4.3
2026-10-27
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
CVE-2026-116340MEDIUMCVSS 4.3EG 4.3
2026-10-26
A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of t…
CVE-2026-116018MEDIUMCVSS 4.3EG 4.3
2026-10-24
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate seq…
CVE-2026-116017MEDIUMCVSS 4.3EG 4.3
2026-10-24
Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers wi…
CVE-2026-116015MEDIUMCVSS 4.3EG 4.3
2026-10-24
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. A…
CVE-2026-116010MEDIUMCVSS 4.3EG 4.3
2026-10-24
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, value…
CVE-2026-115998MEDIUMCVSS 4.3EG 4.3
2026-10-24
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify findi…
CVE-2026-115803MEDIUMCVSS 4.3EG 4.3
2026-10-24
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can…
CVE-2026-113489MEDIUMCVSS 4.3EG 4.3
2026-10-24
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and fe…
CVE-2026-93634MEDIUMCVSS 4.3EG 4.3
2026-10-23
A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-a…
CVE-2026-115322MEDIUMCVSS 4.3EG 4.3
2026-10-22
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on o…
CVE-2026-115321MEDIUMCVSS 4.3EG 4.3
2026-10-22
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any pr…
CVE-2026-112868MEDIUMCVSS 4.3EG 4.3
2026-10-21
Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.
CVE-2026-114395MEDIUMCVSS 4.3EG 4.3
2026-10-21
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId …
CVE-2026-114394MEDIUMCVSS 4.3EG 4.3
2026-10-21
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, post…
CVE-2026-114393MEDIUMCVSS 4.3EG 4.3
2026-10-21
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticke…
CVE-2026-114389MEDIUMCVSS 4.3EG 4.3
2026-10-21
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumer…
CVE-2026-113643MEDIUMCVSS 4.3EG 4.3
2026-10-20
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manip…
CVE-2026-113655MEDIUMCVSS 4.3EG 4.3
2026-10-20
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move oper…
CVE-2026-113598MEDIUMCVSS 4.3EG 4.3
2026-10-20
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs…
CVE-2026-113359MEDIUMCVSS 4.3EG 4.3
2026-10-20
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retri…
CVE-2026-113349MEDIUMCVSS 4.3EG 4.3
2026-10-20
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access c…
CVE-2026-112294MEDIUMCVSS 4.3EG 4.3
2026-10-19
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered use…
CVE-2026-110902MEDIUMCVSS 4.3EG 4.3
2026-10-19
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through…
CVE-2026-92715MEDIUMCVSS 4.3EG 4.3
2026-10-17
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled…
CVE-2026-111717MEDIUMCVSS 4.3EG 4.3
2026-10-16
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the …
CVE-2026-111715MEDIUMCVSS 4.3EG 4.3
2026-10-16
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permissio…
CVE-2026-111705MEDIUMCVSS 4.3EG 4.3
2026-10-16
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attacker…
CVE-2026-111689MEDIUMCVSS 4.3EG 4.3
2026-10-16
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departme…
CVE-2026-111676MEDIUMCVSS 4.3EG 4.3
2026-10-16
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket…
CVE-2026-111674MEDIUMCVSS 4.3EG 4.3
2026-10-16
Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public im…
CVE-2026-111672MEDIUMCVSS 4.3EG 4.3
2026-10-16
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipelin…
CVE-2026-111667MEDIUMCVSS 4.3EG 4.3
2026-10-16
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id o…
CVE-2026-111657MEDIUMCVSS 4.3EG 4.3
2026-10-16
BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA…
CVE-2026-111647MEDIUMCVSS 4.3EG 4.3
2026-10-16
PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers c…
CVE-2026-111629MEDIUMCVSS 4.3EG 4.3
2026-10-16
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attack…
CVE-2026-111621MEDIUMCVSS 4.3EG 4.3
2026-10-16
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a …
CVE-2026-111603MEDIUMCVSS 4.3EG 4.3
2026-10-16
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequ…
CVE-2026-89280MEDIUMCVSS 4.3EG 4.3
2026-10-16
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' …
CVE-2026-111345MEDIUMCVSS 4.3EG 4.3
2026-10-15
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, whi…

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →