CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

2,998 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 40 of 60

CVE-2026-88910MEDIUMCVSS 5.3EG 5.3
2026-09-16
The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers.
CVE-2026-82125MEDIUMCVSS 5.3EG 5.3
2026-09-16
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of commen…
CVE-2026-90517MEDIUMCVSS 5.3EG 5.3
2026-09-13
A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may …
CVE-2026-87894MEDIUMCVSS 5.3EG 5.3
2026-09-12
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing u…
CVE-2026-81915MEDIUMCVSS 5.3EG 5.3
2026-09-11
Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditP…
CVE-2026-62140MEDIUMCVSS 5.3EG 5.3
2026-09-11
Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.
CVE-2026-82213MEDIUMCVSS 5.3EG 5.3
2026-09-11
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references…
CVE-2026-82305MEDIUMCVSS 5.3EG 5.3
2026-09-11
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.
CVE-2026-54529MEDIUMCVSS 5.3EG 5.3
2026-09-09
SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured column_sortable_lis…
CVE-2026-85037MEDIUMCVSS 5.3EG 5.3
2026-09-09
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price d…
CVE-2026-4945MEDIUMCVSS 5.3EG 5.3
2026-09-07
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to miss…
CVE-2026-86183MEDIUMCVSS 5.3EG 5.3
2026-09-06
A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argum…
CVE-2026-81424MEDIUMCVSS 5.3EG 5.3
2026-09-05
The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at …
CVE-2026-79630MEDIUMCVSS 5.3EG 5.3
2026-09-04
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product…
CVE-2026-85381MEDIUMCVSS 5.3EG 5.3
2026-09-04
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Home/Controller/ChapterController.cla…
CVE-2026-85308MEDIUMCVSS 5.3EG 5.3
2026-09-03
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.
CVE-2026-84771MEDIUMCVSS 5.3EG 5.3
2026-09-02
Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.
CVE-2026-15232MEDIUMCVSS 5.3EG 5.3
2026-09-02
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to per…
CVE-2026-82395MEDIUMCVSS 5.3EG 5.3
2026-08-31
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media it…
CVE-2026-82602MEDIUMCVSS 5.3EG 5.3
2026-08-31
A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been discl…
CVE-2026-55867MEDIUMCVSS 5.3EG 5.3
2026-08-28
Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implemented by UsersResource.revokeToken() in graylog2-server/src/main/java/org/graylog2/…
CVE-2026-82290MEDIUMCVSS 5.3EG 5.3
2026-08-28
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating da…
CVE-2026-16567MEDIUMCVSS 5.3EG 5.3
2026-08-27
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin be…
CVE-2026-77990MEDIUMCVSS 5.3EG 5.3
2026-08-27
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not …
CVE-2026-3235MEDIUMCVSS 5.3EG 5.3
2026-08-26
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it po…
CVE-2026-13404MEDIUMCVSS 5.3EG 5.3
2026-08-26
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrar…
CVE-2026-78278MEDIUMCVSS 5.3EG 5.3
2026-08-24
Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-67358MEDIUMCVSS 5.3EG 5.3
2026-08-21
Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging t…
CVE-2026-77780MEDIUMCVSS 5.3EG 5.3
2026-08-21
Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank accoun…
CVE-2026-64969MEDIUMCVSS 5.3EG 5.3
2026-08-20
ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's member_id in a POST request to the profile album endpoint …
CVE-2026-16058MEDIUMCVSS 5.3EG 5.3
2026-08-19
The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order to…
CVE-2026-50167MEDIUMCVSS 5.3EG 5.3
2026-08-18
Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API r…
CVE-2026-74009MEDIUMCVSS 5.3EG 5.3
2026-08-18
Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
CVE-2026-16309MEDIUMCVSS 5.3EG 5.3
2026-08-18
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
CVE-2026-14832MEDIUMCVSS 5.3EG 5.3
2026-08-17
The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to re…
CVE-2026-12998MEDIUMCVSS 5.3EG 5.3
2026-08-16
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing valida…
CVE-2026-18750MEDIUMCVSS 5.3EG 5.3
2026-08-12
vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notificat…
CVE-2026-72802MEDIUMCVSS 5.3EG 5.3
2026-08-12
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from pu…
CVE-2026-16737MEDIUMCVSS 5.3EG 5.3
2026-08-12
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disc…
CVE-2026-68870MEDIUMCVSS 5.3EG 5.3
2026-08-10
The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode …
CVE-2026-66058MEDIUMCVSS 5.3EG 5.3
2026-08-07
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.
CVE-2026-15147MEDIUMCVSS 5.3EG 5.3
2026-08-06
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the inten…
CVE-2026-14842MEDIUMCVSS 5.3EG 5.3
2026-08-06
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-pr…
CVE-2026-28180MEDIUMCVSS 5.3EG 5.3
2026-08-06
Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.
CVE-2026-14313MEDIUMCVSS 5.3EG 5.3
2026-08-06
PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), all versions up to and including 2.8.0 (latest on wordpress.org; no fixed version…
CVE-2026-16981MEDIUMCVSS 5.3EG 5.3
2026-08-05
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attack…
CVE-2025-14073MEDIUMCVSS 5.3EG 5.3
2026-08-01
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insights_script_on_order_…
CVE-2026-17567MEDIUMCVSS 5.3EG 5.3
2026-07-31
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter…
CVE-2026-14843MEDIUMCVSS 5.3EG 5.3
2026-07-31
The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token…
CVE-2026-13345MEDIUMCVSS 5.3EG 5.3
2026-07-30
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclo…

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →