CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

2,116 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 23 of 43

CVE-2025-41099MEDIUMCVSS 6.5EG 6.5
2025-09-30
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the list of permis…
CVE-2025-4119MEDIUMCVSS 5.3EG 5.3
2025-04-30
A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Product Statistics Handler. The manipulation of the argument isDelete with the input 1…
CVE-2025-4129HIGHCVSS 7.5EG 7.5
2025-07-21
Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: before 13.05.2025.
CVE-2025-41358HIGHCVSS 8.3EG 8.3
2025-12-10
Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ …
CVE-2025-4210HIGHCVSS 7.3EG 7.3
2025-05-02
A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authoriza…
CVE-2025-42605CRITICALCVSS 9.3EG 9.3
2025-04-23
This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellation operations. An authenticated remote attacker could exploit this vulnerabi…
CVE-2025-43724MEDIUMCVSS 4.4EG 4.4
2025-10-08
Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain unauthorized a…
CVE-2025-43732LOWCVSS 2.7EG 2.7
2025-08-18
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vul…
CVE-2025-43782MEDIUMCVSS 4.3EG 4.3
2025-09-11
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote authenticated users to a…
CVE-2025-43790HIGHCVSS 8.1EG 8.1
2025-09-11
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to fr…
CVE-2025-43803MEDIUMCVSS 4.3EG 4.3
2025-09-19
Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 G…
CVE-2025-43810MEDIUMCVSS 4.3EG 4.3
2025-09-22
Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remot…
CVE-2025-43827MEDIUMCVSS 4.3EG 4.3
2025-09-30
Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through…
CVE-2025-4596MEDIUMCVSS 5.3EG 5.3
2026-01-08
Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs. This issue has been fixed in 6.09.01.62 ve…
CVE-2025-45968CRITICALCVSS 9.8EG 9.8
2025-08-25
An issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL. The application contains an Insecure Direct Object Reference (IDOR) vulnerability, which occurs due to a lack of proper a…
CVE-2025-46386HIGHCVSS 8.8EG 8.8
2025-08-06
CWE-639 Authorization Bypass Through User-Controlled Key
CVE-2025-46387HIGHCVSS 8.8EG 8.8
2025-08-06
CWE-639 Authorization Bypass Through User-Controlled Key
CVE-2025-4691MEDIUMCVSS 5.3EG 5.3
2025-05-31
The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to mi…
CVE-2025-47226MEDIUMCVSS 5.0EG 5.0
2025-05-02
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
CVE-2025-47555HIGHCVSS 3.8EG 8.1
2026-01-22
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
CVE-2025-4796HIGHCVSS 8.8EG 8.8
2025-08-08
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating t…
CVE-2025-4855CRITICALCVSS 9.8EG 9.8
2025-07-09
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it po…
CVE-2025-49135MEDIUMCVSS 6.5EG 6.5
2025-06-25
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the quer…
CVE-2025-49334MEDIUMCVSS 5.3EG 5.3
2025-12-31
Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.7.1.
CVE-2025-49352MEDIUMCVSS 4.3EG 4.3
2025-12-31
Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff…
CVE-2025-49952HIGHCVSS 6.5EG 8.1
2025-10-22
Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.
CVE-2025-49978MEDIUMCVSS 4.3EG 4.3
2025-06-20
Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through < 3.0.6.
CVE-2025-49995MEDIUMCVSS 5.3EG 5.3
2025-06-20
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a …
CVE-2025-50340MEDIUMCVSS 4.3EG 4.3
2025-08-04
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of other users by manipulating a user-controlled identifier in the email-sending re…
CVE-2025-50693MEDIUMCVSS 6.5EG 6.5
2025-06-24
PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Insecure Direct Object Reference (IDOR) in odms/request-details.php.
CVE-2025-50849HIGHCVSS 8.0EG 8.0
2025-07-31
CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference (IDOR). The user profile functionality allows enabling or disabling stickers through a parameter (company_id) sent in the request. However, this operation is not properly val…
CVE-2025-51479MEDIUMCVSS 5.4EG 5.4
2025-07-22
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypa…
CVE-2025-51533MEDIUMCVSS 5.3EG 5.3
2025-08-07
An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request.
CVE-2025-51628HIGHCVSS 7.5EG 7.5
2025-08-05
Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthenticated attackers to read confidential documents via the DocumentoId parameter.
CVE-2025-5181MEDIUMCVSS 4.1EG 4.1
2025-05-26
A vulnerability, which was classified as problematic, was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. This affects an unknown part of the file /spgpm/updateListing. The manipulation of the argument spgLsTit…
CVE-2025-5182HIGHCVSS 7.5EG 7.5
2025-05-26
A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unknown code of the component Listing Handler. The manipulation leads to authorizat…
CVE-2025-51865HIGHCVSS 8.8EG 8.8
2025-07-22
Ai2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object Reference (IDOR), allowing attackers to gain sensitvie information via enumerating thread keys in the URL.
CVE-2025-51867MEDIUMCVSS 6.5EG 6.5
2025-07-22
Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing attackers to chat with the LLM using other users' credits via sensitive information gained by the /browse/stories endpoint.
CVE-2025-51868HIGHCVSS 7.5EG 7.5
2025-07-21
Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive information via the conversation_id parameter to the conversation_history endpoint.
CVE-2025-51869HIGHCVSS 7.5EG 7.5
2025-07-21
Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted space_id, thread_id, and message_id parameters to the v1/space/{space_id}/thread/{thread_id}/message/…
CVE-2025-5195MEDIUMCVSS 4.3EG 4.3
2025-06-12
An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. It was possible for authenticated users to access arbitrary compliance frameworks, leading to unaut…
CVE-2025-52389HIGHCVSS 8.8EG 8.8
2025-09-08
An Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows authenticated attackers to access sensitive data for other users via a crafted HTTP request.
CVE-2025-52446HIGHCVSS 8.0EG 8.0
2025-07-25
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau S…
CVE-2025-52447HIGHCVSS 8.1EG 8.1
2025-07-25
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This iss…
CVE-2025-52448HIGHCVSS 8.1EG 8.1
2025-07-25
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue aff…
CVE-2025-5261HIGHCVSS 7.5EG 7.5
2025-08-20
Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of Trusted Identifiers. This issue affects Pik Online: before 3.1.5.
CVE-2025-52670HIGHCVSS 6.5EG 7.1
2025-11-20
Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts
CVE-2025-53208HIGHCVSS 7.5EG 7.5
2025-08-20
Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through <…
CVE-2025-53357MEDIUMCVSS 5.4EG 5.4
2025-07-30
GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.78 through 10.0.18, a conn…
CVE-2025-53640MEDIUMCVSS 6.5EG 6.5
2025-07-14
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (suc…

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →