CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

3,460 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 65 of 70

CVE-2022-3413MEDIUMCVSS 4.3EG 4.3
2022-11-10
Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or M…
CVE-2022-3282MEDIUMCVSS 4.3EG 4.3
2022-10-17
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the…
CVE-2022-42067MEDIUMCVSS 4.3EG 4.3
2022-10-14
Online Birth Certificate Management System version 1.0 suffers from an Insecure Direct Object Reference (IDOR) vulnerability
CVE-2022-1580MEDIUMCVSS 4.3EG 4.3
2022-09-19
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypas…
CVE-2022-2913MEDIUMCVSS 4.3EG 4.3
2022-09-16
The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.
CVE-2022-2080MEDIUMCVSS 4.3EG 4.3
2022-08-29
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR a…
CVE-2022-2198MEDIUMCVSS 4.3EG 4.3
2022-08-22
The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the m…
CVE-2022-30852MEDIUMCVSS 4.3EG 4.3
2022-07-08
Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).
CVE-2022-30760MEDIUMCVSS 4.3EG 4.3
2022-06-09
An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information (final grades, study courses, degrees) by changing the student ID…
CVE-2022-29627MEDIUMCVSS 4.3EG 4.3
2022-06-02
An insecure direct object reference (IDOR) in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers.
CVE-2022-1810MEDIUMCVSS 4.3EG 4.3
2022-05-23
Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9.
CVE-2022-1425MEDIUMCVSS 4.3EG 4.3
2022-05-16
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being …
CVE-2021-24800MEDIUMCVSS 4.3EG 4.3
2022-04-25
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.
CVE-2022-27108MEDIUMCVSS 4.3EG 4.3
2022-04-06
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any user can create a timesheet in another user's account.
CVE-2022-0442MEDIUMCVSS 4.3EG 4.3
2022-03-07
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
CVE-2022-21713MEDIUMCVSS 4.3EG 4.3
2022-02-08
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view …
CVE-2021-44836MEDIUMCVSS 4.3EG 4.3
2022-01-18
An issue was discovered in Delta RM 1.2. The /risque/risque/workflow/reset endpoint is lacking access controls, and it is possible for an unprivileged user to reopen a risk with a POST request, using the risqueID parameter to identify the …
CVE-2021-39934MEDIUMCVSS 4.3EG 4.3
2021-12-13
Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.…
CVE-2021-39916MEDIUMCVSS 4.3EG 4.3
2021-12-13
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 b…
CVE-2021-39889MEDIUMCVSS 4.3EG 4.3
2021-10-05
In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branc…
CVE-2021-33981MEDIUMCVSS 4.3EG 4.3
2021-09-08
An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people's personal information and im…
CVE-2021-37215MEDIUMCVSS 4.3EG 4.3
2021-08-09
The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s use…
CVE-2021-37213MEDIUMCVSS 4.3EG 4.3
2021-08-09
The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access partic…
CVE-2021-35337MEDIUMCVSS 4.3EG 4.3
2021-07-01
Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter.
CVE-2021-31927MEDIUMCVSS 4.3EG 4.3
2021-06-10
An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. …
CVE-2020-6641MEDIUMCVSS 4.3EG 4.3
2021-06-02
Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters.
CVE-2020-26679MEDIUMCVSS 4.3EG 4.3
2021-05-26
vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their…
CVE-2020-8297MEDIUMCVSS 4.3EG 4.3
2021-02-23
Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user.
CVE-2020-36231MEDIUMCVSS 4.3EG 4.3
2021-02-02
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before…
CVE-2020-26171MEDIUMCVSS 4.3EG 4.3
2020-12-18
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them.
CVE-2020-13357MEDIUMCVSS 4.3EG 4.3
2020-12-11
An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project.
CVE-2020-27663MEDIUMCVSS 4.3EG 4.3
2020-11-26
In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).
CVE-2020-27662MEDIUMCVSS 4.3EG 4.3
2020-11-26
In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.).
CVE-2020-8235MEDIUMCVSS 4.3EG 4.3
2020-10-05
Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments.
CVE-2020-12643MEDIUMCVSS 4.3EG 4.3
2020-08-31
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.
CVE-2020-14174MEDIUMCVSS 4.3EG 4.3
2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versi…
CVE-2017-18878MEDIUMCVSS 4.3EG 4.3
2020-06-19
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
CVE-2020-5743MEDIUMCVSS 4.3EG 4.3
2020-05-07
Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don't have permission.
CVE-2020-11659MEDIUMCVSS 4.3EG 4.3
2020-04-15
CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administration action.
CVE-2020-11585MEDIUMCVSS 4.3EG 4.3
2020-04-06
There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones…
CVE-2020-9468MEDIUMCVSS 4.3EG 4.3
2020-03-26
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter.
CVE-2019-18626MEDIUMCVSS 4.3EG 4.3
2020-03-25
Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo value to the ORMEDMIS/Data/PY/T4W2Service.svc/RetrieveW2EntriesForEmployee URI, thus exposing sensitiv…
CVE-2019-5466MEDIUMCVSS 4.3EG 4.3
2020-01-28
An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.
CVE-2019-19259MEDIUMCVSS 4.3EG 4.3
2020-01-03
GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR).
CVE-2019-19616MEDIUMCVSS 4.3EG 4.3
2019-12-06
An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the…
CVE-2019-17604MEDIUMCVSS 4.3EG 4.3
2019-11-07
An Insecure Direct Object Reference (IDOR) vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidates' personal information (first name, last name, email, CV, phone number, and all other personal in…
CVE-2019-16723MEDIUMCVSS 4.3EG 4.3
2019-09-23
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.
CVE-2019-14725MEDIUMCVSS 4.3EG 4.3
2019-09-11
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account.
CVE-2018-19582MEDIUMCVSS 4.3EG 4.3
2019-07-10
GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user.
CVE-2018-19575MEDIUMCVSS 4.3EG 4.3
2019-07-10
GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue.

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →