CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

3,025 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 57 of 61

CVE-2023-4023MEDIUMCVSS 4.3EG 4.3
2023-08-30
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.
CVE-2023-3601MEDIUMCVSS 4.3EG 4.3
2023-08-14
The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.
CVE-2023-30960MEDIUMCVSS 4.3EG 4.3
2023-07-10
A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was roll…
CVE-2023-0692MEDIUMCVSS 4.3EG 4.3
2023-06-09
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capa…
CVE-2023-0691MEDIUMCVSS 4.3EG 4.3
2023-06-09
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilit…
CVE-2023-33956MEDIUMCVSS 4.3EG 4.3
2023-06-05
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application's URL parameter. This v…
CVE-2023-1911MEDIUMCVSS 4.3EG 4.3
2023-05-02
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example
CVE-2023-1417MEDIUMCVSS 4.3EG 4.3
2023-04-05
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unre…
CVE-2023-28334MEDIUMCVSS 4.3EG 4.3
2023-03-23
Authenticated users were able to enumerate other users' names via the learning plans page.
CVE-2023-0453MEDIUMCVSS 4.3EG 4.3
2023-02-21
The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users t…
CVE-2022-3995MEDIUMCVSS 4.3EG 4.3
2022-11-29
The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. Th…
CVE-2022-42129MEDIUMCVSS 4.3EG 4.3
2022-11-15
An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form …
CVE-2022-3413MEDIUMCVSS 4.3EG 4.3
2022-11-10
Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or M…
CVE-2022-3282MEDIUMCVSS 4.3EG 4.3
2022-10-17
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the…
CVE-2022-42067MEDIUMCVSS 4.3EG 4.3
2022-10-14
Online Birth Certificate Management System version 1.0 suffers from an Insecure Direct Object Reference (IDOR) vulnerability
CVE-2022-1580MEDIUMCVSS 4.3EG 4.3
2022-09-19
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypas…
CVE-2022-2913MEDIUMCVSS 4.3EG 4.3
2022-09-16
The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.
CVE-2022-2080MEDIUMCVSS 4.3EG 4.3
2022-08-29
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR a…
CVE-2022-2198MEDIUMCVSS 4.3EG 4.3
2022-08-22
The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the m…
CVE-2022-30852MEDIUMCVSS 4.3EG 4.3
2022-07-08
Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).
CVE-2022-30760MEDIUMCVSS 4.3EG 4.3
2022-06-09
An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information (final grades, study courses, degrees) by changing the student ID…
CVE-2022-29627MEDIUMCVSS 4.3EG 4.3
2022-06-02
An insecure direct object reference (IDOR) in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers.
CVE-2022-1810MEDIUMCVSS 4.3EG 4.3
2022-05-23
Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9.
CVE-2022-1425MEDIUMCVSS 4.3EG 4.3
2022-05-16
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being …
CVE-2021-24800MEDIUMCVSS 4.3EG 4.3
2022-04-25
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.
CVE-2022-27108MEDIUMCVSS 4.3EG 4.3
2022-04-06
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any user can create a timesheet in another user's account.
CVE-2022-0442MEDIUMCVSS 4.3EG 4.3
2022-03-07
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
CVE-2022-21713MEDIUMCVSS 4.3EG 4.3
2022-02-08
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view …
CVE-2021-44836MEDIUMCVSS 4.3EG 4.3
2022-01-18
An issue was discovered in Delta RM 1.2. The /risque/risque/workflow/reset endpoint is lacking access controls, and it is possible for an unprivileged user to reopen a risk with a POST request, using the risqueID parameter to identify the …
CVE-2021-39934MEDIUMCVSS 4.3EG 4.3
2021-12-13
Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.…
CVE-2021-39916MEDIUMCVSS 4.3EG 4.3
2021-12-13
Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 b…
CVE-2021-39889MEDIUMCVSS 4.3EG 4.3
2021-10-05
In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branc…
CVE-2021-33981MEDIUMCVSS 4.3EG 4.3
2021-09-08
An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people's personal information and im…
CVE-2021-37215MEDIUMCVSS 4.3EG 4.3
2021-08-09
The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s use…
CVE-2021-37213MEDIUMCVSS 4.3EG 4.3
2021-08-09
The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access partic…
CVE-2021-35337MEDIUMCVSS 4.3EG 4.3
2021-07-01
Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter.
CVE-2021-31927MEDIUMCVSS 4.3EG 4.3
2021-06-10
An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. …
CVE-2020-6641MEDIUMCVSS 4.3EG 4.3
2021-06-02
Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters.
CVE-2020-26679MEDIUMCVSS 4.3EG 4.3
2021-05-26
vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or profile picture. After receiving any user's unique identification number and their…
CVE-2020-8297MEDIUMCVSS 4.3EG 4.3
2021-02-23
Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user.
CVE-2020-36231MEDIUMCVSS 4.3EG 4.3
2021-02-02
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before…
CVE-2020-26171MEDIUMCVSS 4.3EG 4.3
2020-12-18
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them.
CVE-2020-13357MEDIUMCVSS 4.3EG 4.3
2020-12-11
An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project.
CVE-2020-27663MEDIUMCVSS 4.3EG 4.3
2020-11-26
In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).
CVE-2020-27662MEDIUMCVSS 4.3EG 4.3
2020-11-26
In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.).
CVE-2020-8235MEDIUMCVSS 4.3EG 4.3
2020-10-05
Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments.
CVE-2020-12643MEDIUMCVSS 4.3EG 4.3
2020-08-31
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.
CVE-2020-14174MEDIUMCVSS 4.3EG 4.3
2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versi…
CVE-2020-5743MEDIUMCVSS 4.3EG 4.3
2020-05-07
Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don't have permission.
CVE-2020-11659MEDIUMCVSS 4.3EG 4.3
2020-04-15
CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administration action.

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →