CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

3,025 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 56 of 61

CVE-2024-9298MEDIUMCVSS 4.3EG 4.3
2024-09-28
A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /?page=tickets of the component Ticket Handler. The manip…
CVE-2024-25270MEDIUMCVSS 4.3EG 4.3
2024-09-12
An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulating the ID parameter and increment STEP parameter, leading to the exposure of sensitive user data.
CVE-2024-43916MEDIUMCVSS 4.3EG 4.3
2024-08-26
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.
CVE-2024-7848MEDIUMCVSS 4.3EG 4.3
2024-08-22
The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpk_upvf_update_doc' due to missing validation on the 'doc…
CVE-2024-43288MEDIUMCVSS 4.3EG 4.3
2024-08-18
Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.
CVE-2024-43239MEDIUMCVSS 4.3EG 4.3
2024-08-18
Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.
CVE-2023-7049MEDIUMCVSS 4.3EG 4.3
2024-08-16
The Custom Field For WP Job Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2 via the the 'cm_fieldshow' shortcode due to missing validation on the 'job_id' user contro…
CVE-2024-6534MEDIUMCVSS 4.3EG 4.3
2024-08-15
Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' reque…
CVE-2024-7438MEDIUMCVSS 4.3EG 4.3
2024-08-03
A vulnerability has been found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?action=profile;u=2;area=showalerts;do=read of the component User Al…
CVE-2024-38701MEDIUMCVSS 4.3EG 4.3
2024-07-22
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
CVE-2024-6410MEDIUMCVSS 4.3EG 4.3
2024-07-10
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pm_upload_image' function due to missing validation on a …
CVE-2024-39897MEDIUMCVSS 4.3EG 4.3
2024-07-09
zot is an OCI image registry. Prior to 2.1.0, the cache driver `GetBlob()` allows read access to any blob without access control check. If a Zot `accessControl` policy allows users read access to some repositories but restricts read access…
CVE-2024-21759MEDIUMCVSS 4.3EG 4.3
2024-07-09
An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 allows attacker to view unauthorized resources via HTTP or HTTPS requests.
CVE-2024-5942MEDIUMCVSS 4.3EG 4.3
2024-06-29
The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it pos…
CVE-2024-4874MEDIUMCVSS 4.3EG 4.3
2024-06-22
The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for a…
CVE-2024-5639MEDIUMCVSS 4.3EG 4.3
2024-06-21
The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image' function due to missing validation on a user controlled key…
CVE-2024-4873MEDIUMCVSS 4.3EG 4.3
2024-06-19
The Replace Image plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.10 via the image replacement functionality due to missing validation on a user controlled key. This makes it…
CVE-2024-5438MEDIUMCVSS 4.3EG 4.3
2024-06-07
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user…
CVE-2024-4886MEDIUMCVSS 4.3EG 4.3
2024-06-05
The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request
CVE-2024-4274MEDIUMCVSS 4.3EG 4.3
2024-06-04
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax() function in all versions up to, and including, 4.4.2. This makes it possible …
CVE-2024-4843MEDIUMCVSS 4.3EG 4.3
2024-05-16
ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a least privileged user to manipulate the client task and client task assignments, hence escalating his/her privilege.
CVE-2024-4819MEDIUMCVSS 4.3EG 4.3
2024-05-14
A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file admin_class.php. The manipulation of the argument type with the input 1 leads t…
CVE-2024-1693MEDIUMCVSS 4.3EG 4.3
2024-05-14
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it poss…
CVE-2024-33542MEDIUMCVSS 4.3EG 4.3
2024-04-29
Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5.
CVE-2024-32772MEDIUMCVSS 4.3EG 4.3
2024-04-24
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.
CVE-2023-6897MEDIUMCVSS 4.3EG 4.3
2024-04-18
The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. …
CVE-2024-32604MEDIUMCVSS 4.3EG 4.3
2024-04-18
Authorization Bypass Through User-Controlled Key vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5.
CVE-2024-2543MEDIUMCVSS 4.3EG 4.3
2024-04-09
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unaut…
CVE-2024-2261MEDIUMCVSS 4.3EG 4.3
2024-04-09
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contri…
CVE-2024-0872MEDIUMCVSS 4.3EG 4.3
2024-04-09
The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu-userinfo shortcode. This makes it possible for authenticated attackers, with contributor-level acce…
CVE-2024-31296MEDIUMCVSS 4.3EG 4.3
2024-04-07
Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.
CVE-2024-31291MEDIUMCVSS 4.3EG 4.3
2024-04-07
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6.
CVE-2023-7198MEDIUMCVSS 4.3EG 4.3
2024-02-27
The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses…
CVE-2024-0366MEDIUMCVSS 4.3EG 4.3
2024-02-05
The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user controlled key. This m…
CVE-2023-6983MEDIUMCVSS 4.3EG 4.3
2024-02-05
The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.1 via the vg_display_data shortcode due to missing …
CVE-2023-6384MEDIUMCVSS 4.3EG 4.3
2024-01-22
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar
CVE-2023-6504MEDIUMCVSS 4.3EG 4.3
2024-01-11
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler funct…
CVE-2023-6506MEDIUMCVSS 4.3EG 4.3
2024-01-11
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user c…
CVE-2023-6223MEDIUMCVSS 4.3EG 4.3
2024-01-11
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlle…
CVE-2023-6630MEDIUMCVSS 4.3EG 4.3
2024-01-11
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missin…
CVE-2023-50267MEDIUMCVSS 4.3EG 4.3
2023-12-28
MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are…
CVE-2022-43450MEDIUMCVSS 4.3EG 4.3
2023-12-19
Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2.
CVE-2023-6226MEDIUMCVSS 4.3EG 4.3
2023-11-28
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled…
CVE-2023-48304MEDIUMCVSS 4.3EG 4.3
2023-11-21
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2…
CVE-2023-4836MEDIUMCVSS 4.3EG 4.3
2023-10-31
The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced
CVE-2023-3707MEDIUMCVSS 4.3EG 4.3
2023-10-16
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as dr…
CVE-2023-3706MEDIUMCVSS 4.3EG 4.3
2023-10-16
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft …
CVE-2023-2172MEDIUMCVSS 4.3EG 4.3
2023-08-31
The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeos_update_steps_ajax_handler, badgeos…
CVE-2023-0689MEDIUMCVSS 4.3EG 4.3
2023-08-31
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabili…
CVE-2023-4036MEDIUMCVSS 4.3EG 4.3
2023-08-30
The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft…

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →