CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

3,008 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 43 of 61

CVE-2025-12883MEDIUMCVSS 5.3EG 5.3
2025-12-12
The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly validating that a transaction has occurred thro…
CVE-2025-13748MEDIUMCVSS 5.3EG 5.3
2025-12-06
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' paramet…
CVE-2025-66513MEDIUMCVSS 5.3EG 5.3
2025-12-05
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited t…
CVE-2025-13157MEDIUMCVSS 5.3EG 5.3
2025-11-27
The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.7 via the 'qode_wishlist_for_woocommerce_wishlist_table_item_callback' function due to missi…
CVE-2025-64067MEDIUMCVSS 5.3EG 5.3
2025-11-25
Primakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records) fail to implement sufficient server-side validation to confirm that the requesting user is authorize…
CVE-2025-13389MEDIUMCVSS 5.3EG 5.3
2025-11-25
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and incl…
CVE-2025-12427MEDIUMCVSS 5.3EG 5.3
2025-11-19
The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys.…
CVE-2025-41069MEDIUMCVSS 5.3EG 5.3
2025-11-13
Insecure Direct Object Reference (IDOR) vulnerability in DeporSite of T-INNOVA. This vulnerability allows an attacker to access or modify unauthorized resources by manipulating requests using the 'idUsuario' parameter in ‘/ajax/TInnova_v…
CVE-2025-11532MEDIUMCVSS 5.3EG 5.3
2025-11-11
The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlist_id' user controlled key. This makes it possible for unauthenticated att…
CVE-2025-12353MEDIUMCVSS 5.3EG 5.3
2025-11-08
The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to…
CVE-2025-11741MEDIUMCVSS 5.3EG 5.3
2025-10-18
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_quickview' AJAX endpoint due to insufficient restrictions on which posts can be …
CVE-2025-40773MEDIUMCVSS 5.3EG 5.3
2025-10-14
A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access control vulnerability. The authorization mechanism lacks sufficient server-side checks, allowing an attac…
CVE-2025-11518MEDIUMCVSS 5.3EG 5.3
2025-10-11
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled ke…
CVE-2025-40676MEDIUMCVSS 5.3EG 5.3
2025-10-07
Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This vulnerability allows an attacker to access or modify unauthorised resources by m…
CVE-2025-10947MEDIUMCVSS 5.3EG 5.3
2025-09-25
A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/validarCpf of the component CPF Handler. Executing a manipulation of the argument …
CVE-2025-7106MEDIUMCVSS 5.3EG 5.3
2025-09-23
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/middleware/roles/access.js` uses `permissions.some()` to validate permissions, whic…
CVE-2025-10759MEDIUMCVSS 5.3EG 5.3
2025-09-21
A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated re…
CVE-2025-10493MEDIUMCVSS 5.3EG 5.3
2025-09-18
The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible…
CVE-2025-8463MEDIUMCVSS 5.3EG 5.3
2025-09-17
Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHard: before 3.6.2-20250805.
CVE-2025-54691MEDIUMCVSS 5.3EG 5.3
2025-08-14
Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through…
CVE-2025-3089MEDIUMCVSS 5.3EG 5.3
2025-08-12
ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically…
CVE-2025-8755MEDIUMCVSS 5.3EG 5.3
2025-08-09
A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController.java of the component com.macro.mall.portal.controller. The manipulation of the …
CVE-2025-51533MEDIUMCVSS 5.3EG 5.3
2025-08-07
An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request.
CVE-2025-49995MEDIUMCVSS 5.3EG 5.3
2025-06-20
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a …
CVE-2025-4691MEDIUMCVSS 5.3EG 5.3
2025-05-31
The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to mi…
CVE-2025-3769MEDIUMCVSS 5.3EG 5.3
2025-05-14
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to mis…
CVE-2024-8988MEDIUMCVSS 5.3EG 5.3
2025-05-14
The PeepSo Core: File Uploads plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.6.0 via the file_download REST API endpoint due to missing validation on a user controlled key. …
CVE-2025-3281MEDIUMCVSS 5.3EG 5.3
2025-05-06
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the create_stripe_subscrip…
CVE-2025-3889MEDIUMCVSS 5.3EG 5.3
2025-05-01
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This m…
CVE-2025-4119MEDIUMCVSS 5.3EG 5.3
2025-04-30
A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Product Statistics Handler. The manipulation of the argument isDelete with the input 1…
CVE-2025-31950MEDIUMCVSS 5.3EG 5.3
2025-04-15
An unauthenticated attacker can obtain EV charger energy consumption information of other users.
CVE-2025-31945MEDIUMCVSS 5.3EG 5.3
2025-04-15
An unauthenticated attacker can obtain other users' charger information.
CVE-2025-31654MEDIUMCVSS 5.3EG 5.3
2025-04-15
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
CVE-2025-31147MEDIUMCVSS 5.3EG 5.3
2025-04-15
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
CVE-2025-30257MEDIUMCVSS 5.3EG 5.3
2025-04-15
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
CVE-2025-27929MEDIUMCVSS 5.3EG 5.3
2025-04-15
Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
CVE-2025-27927MEDIUMCVSS 5.3EG 5.3
2025-04-15
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.
CVE-2025-27719MEDIUMCVSS 5.3EG 5.3
2025-04-15
Unauthenticated attackers can query an API endpoint and get device details.
CVE-2025-27575MEDIUMCVSS 5.3EG 5.3
2025-04-15
An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.
CVE-2025-27565MEDIUMCVSS 5.3EG 5.3
2025-04-15
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
CVE-2025-27561MEDIUMCVSS 5.3EG 5.3
2025-04-15
Unauthenticated attackers can rename "rooms" of arbitrary users.
CVE-2025-26857MEDIUMCVSS 5.3EG 5.3
2025-04-15
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
CVE-2025-25276MEDIUMCVSS 5.3EG 5.3
2025-04-15
An unauthenticated attacker can hijack other users' devices and potentially control them.
CVE-2025-24850MEDIUMCVSS 5.3EG 5.3
2025-04-15
An attacker can export other users' plant information.
CVE-2025-24315MEDIUMCVSS 5.3EG 5.3
2025-04-15
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
CVE-2025-31949MEDIUMCVSS 5.3EG 5.3
2025-04-15
An authenticated attacker can obtain any plant name by knowing the plant ID.
CVE-2025-31941MEDIUMCVSS 5.3EG 5.3
2025-04-15
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
CVE-2025-31933MEDIUMCVSS 5.3EG 5.3
2025-04-15
An unauthenticated attacker can check the existence of usernames in the system by querying an API.
CVE-2025-31357MEDIUMCVSS 5.3EG 5.3
2025-04-15
An unauthenticated attacker can obtain a user's plant list by knowing the username.
CVE-2025-30514MEDIUMCVSS 5.3EG 5.3
2025-04-15
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →