CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

3,025 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 54 of 61

CVE-2025-41095MEDIUMCVSS 4.3EG 4.3
2025-09-30
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to planning counter d…
CVE-2025-41094MEDIUMCVSS 4.3EG 4.3
2025-09-30
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to functional contra…
CVE-2025-41093MEDIUMCVSS 4.3EG 4.3
2025-09-30
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic contract de…
CVE-2025-41092MEDIUMCVSS 4.3EG 4.3
2025-09-30
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to time records detai…
CVE-2025-41091MEDIUMCVSS 4.3EG 4.3
2025-09-30
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to calendar details u…
CVE-2025-43810MEDIUMCVSS 4.3EG 4.3
2025-09-22
Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remot…
CVE-2025-43803MEDIUMCVSS 4.3EG 4.3
2025-09-19
Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 G…
CVE-2025-10719MEDIUMCVSS 4.3EG 4.3
2025-09-19
Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers with regular privilege to modify a specific parameter to access other users' files.
CVE-2025-43782MEDIUMCVSS 4.3EG 4.3
2025-09-11
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote authenticated users to a…
CVE-2025-59034MEDIUMCVSS 4.3EG 4.3
2025-09-10
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users with…
CVE-2025-58597MEDIUMCVSS 4.3EG 4.3
2025-09-03
Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.6.
CVE-2025-9836MEDIUMCVSS 4.3EG 4.3
2025-09-02
A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderId results in authorization bypass. The attack can be launche…
CVE-2025-9835MEDIUMCVSS 4.3EG 4.3
2025-09-02
A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated re…
CVE-2025-56254MEDIUMCVSS 4.3EG 4.3
2025-09-02
PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in leave-details.php. An authenticated user can change the leaveid parameter in the URL to access leave application details o…
CVE-2025-9263MEDIUMCVSS 4.3EG 4.3
2025-08-20
A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument j…
CVE-2025-8789MEDIUMCVSS 4.3EG 4.3
2025-08-10
A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been classified as problematic. This affects an unknown part of the file /module/Api/Diario of the component API Endpoint. The manipulation leads to authorization bypass.…
CVE-2025-50340MEDIUMCVSS 4.3EG 4.3
2025-08-04
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of other users by manipulating a user-controlled identifier in the email-sending re…
CVE-2025-7938MEDIUMCVSS 4.3EG 4.3
2025-07-21
A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 and classified as critical. This issue affects the function updateGoods of the file GoodsController.java. The manipulation leads to authorization bypass. The at…
CVE-2025-49978MEDIUMCVSS 4.3EG 4.3
2025-06-20
Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through < 3.0.6.
CVE-2025-5195MEDIUMCVSS 4.3EG 4.3
2025-06-12
An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. It was possible for authenticated users to access arbitrary compliance frameworks, leading to unaut…
CVE-2024-45329MEDIUMCVSS 4.3EG 4.3
2025-06-10
A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may allow an authenticated attacker to view unauthorized device information via key m…
CVE-2025-20114MEDIUMCVSS 4.3EG 4.3
2025-05-21
A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to insufficient validatio…
CVE-2025-20214MEDIUMCVSS 4.3EG 4.3
2025-05-07
A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data. This vulnerability…
CVE-2025-1327MEDIUMCVSS 4.3EG 4.3
2025-05-02
The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missing validation on a user controlled key. This makes it possib…
CVE-2025-3640MEDIUMCVSS 4.3EG 4.3
2025-04-25
A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.
CVE-2025-3636MEDIUMCVSS 4.3EG 4.3
2025-04-25
A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks.
CVE-2025-1284MEDIUMCVSS 4.3EG 4.3
2025-04-24
The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1 via the xc_woo_printer_preview AJAX acti…
CVE-2025-39434MEDIUMCVSS 4.3EG 4.3
2025-04-17
Authorization Bypass Through User-Controlled Key vulnerability in Scott Taylor Avatar avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avatar: from n/a through <= 0.1.4.
CVE-2025-3292MEDIUMCVSS 4.3EG 4.3
2025-04-12
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_upda…
CVE-2025-30777MEDIUMCVSS 4.3EG 4.3
2025-03-27
Authorization Bypass Through User-Controlled Key vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.1…
CVE-2024-7476MEDIUMCVSS 4.3EG 4.3
2025-03-20
A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{i…
CVE-2024-13407MEDIUMCVSS 4.3EG 4.3
2025-03-14
The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via the megamenu block due to insufficient restrictions on which posts can be included. This makes it possible for authent…
CVE-2025-27436MEDIUMCVSS 4.3EG 4.3
2025-03-11
The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact with a resource is legitimate, allowing the attacker to delete the attachment of a…
CVE-2025-27433MEDIUMCVSS 4.3EG 4.3
2025-03-11
The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application's…
CVE-2025-26660MEDIUMCVSS 4.3EG 4.3
2025-03-11
SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass ac…
CVE-2025-2125MEDIUMCVSS 4.3EG 4.3
2025-03-09
A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/comprovante_marcacao/?companyId=1 of the component PDF Document Handler. The man…
CVE-2024-12114MEDIUMCVSS 4.3EG 4.3
2025-03-08
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogallery_attachment_moda…
CVE-2024-13832MEDIUMCVSS 4.3EG 4.3
2025-02-28
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'ut_elementor' shortcode due to insufficient restrictions on which posts can be included. Th…
CVE-2025-1607MEDIUMCVSS 4.3EG 4.3
2025-02-24
A vulnerability, which was classified as problematic, has been found in SourceCodester Best Employee Management System 1.0. This issue affects some unknown processing of the file /admin/salary_slip.php. The manipulation of the argument id …
CVE-2024-13873MEDIUMCVSS 4.3EG 4.3
2025-02-22
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.8 via the deleteUserPhoto() function due …
CVE-2024-13855MEDIUMCVSS 4.3EG 4.3
2025-02-20
The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the pae_global_block shortcode due to missing validation on a user controlled key. This m…
CVE-2024-13854MEDIUMCVSS 4.3EG 4.3
2025-02-19
The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naedu_elementor_template shortcode due to missing validation on a user controlled …
CVE-2024-13740MEDIUMCVSS 4.3EG 4.3
2025-02-18
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pm_messenger_show_messages function due to missing valid…
CVE-2025-0661MEDIUMCVSS 4.3EG 4.3
2025-02-13
The DethemeKit For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This ma…
CVE-2024-13601MEDIUMCVSS 4.3EG 4.3
2025-02-12
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due …
CVE-2024-13841MEDIUMCVSS 4.3EG 4.3
2025-02-07
The Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via the 'bse-elementor-template' shortcode due to insu…
CVE-2024-12046MEDIUMCVSS 4.3EG 4.3
2025-02-04
The Medical Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.2 via the 'namedical_elementor_template' shortcode due to missing validation on a user control…
CVE-2024-13607MEDIUMCVSS 4.3EG 4.3
2025-02-04
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a…
CVE-2025-22695MEDIUMCVSS 4.3EG 4.3
2025-02-03
Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support nirweb-support.This issue affects Nirweb support: from n/a through <= 3.0.3.
CVE-2024-13429MEDIUMCVSS 4.3EG 4.3
2025-02-01
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the 'jobenforcedelete' due to missi…

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →