CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

2,706 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 30 of 55

CVE-2026-16039MEDIUMCVSS 6.5EG 6.5
2026-08-07
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each…
CVE-2026-16058MEDIUMCVSS 5.3EG 5.3
2026-08-19
The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order to…
CVE-2026-16070LOWCVSS 2.7EG 2.7
2026-08-04
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation…
CVE-2026-16075MEDIUMCVSS 4.3EG 4.3
2026-07-18
A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard/routes/open_api.py of the component session-listing Endpoint. This manipulation…
CVE-2026-16105MEDIUMCVSS 4.9EG 4.9
2026-07-31
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a dele…
CVE-2026-16142CRITICALCVSS 9.8EG 9.8
2026-08-15
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrar…
CVE-2026-1619HIGHCVSS 8.3EG 8.3
2026-02-13
Authorization Bypass Through User-Controlled Key vulnerability in Universal Software Inc. FlexCity/Kiosk allows Exploitation of Trusted Identifiers. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.
CVE-2026-16214MEDIUMCVSS 6.3EG 6.3
2026-07-19
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be e…
CVE-2026-16217MEDIUMCVSS 6.3EG 6.3
2026-07-19
A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/deli.py of the component Delivery Deployment Endpoint. The manipulation of the arg…
CVE-2026-16281HIGHCVSS 7.1EG 7.1
2026-09-04
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subsc…
CVE-2026-16291MEDIUMCVSS 4.3EG 4.3
2026-08-02
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumeratin…
CVE-2026-16309MEDIUMCVSS 5.3EG 5.3
2026-08-18
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
CVE-2026-16310CRITICALCVSS 9.8EG 9.8
2026-09-06
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthe…
CVE-2026-16450MEDIUMCVSS 4.3EG 4.3
2026-07-21
A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulati…
CVE-2026-16564MEDIUMCVSS 4.3EG 4.3
2026-08-03
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to mod…
CVE-2026-16565MEDIUMCVSS 4.3EG 4.3
2026-08-03
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the pro…
CVE-2026-16567MEDIUMCVSS 5.3EG 5.3
2026-08-27
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin be…
CVE-2026-16568MEDIUMCVSS 4.3EG 4.3
2026-08-27
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowi…
CVE-2026-16574MEDIUMCVSS 5.4EG 5.4
2026-08-08
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order R…
CVE-2026-16624CRITICALCVSS 9.6EG 9.6
2026-07-22
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails an…
CVE-2026-1664MEDIUMCVSS 6.9EG 6.9
2026-02-03
Summary An Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare Agents SDK. The issue occurs because the `Message-ID` and `References` headers are parsed to derive t…
CVE-2026-16737MEDIUMCVSS 5.3EG 5.3
2026-08-12
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disc…
CVE-2026-16746LOWCVSS 2.7EG 2.7
2026-08-05
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.
CVE-2026-16797MEDIUMCVSS 4.3EG 4.3
2026-07-28
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing…
CVE-2026-16953MEDIUMCVSS 4.8EG 4.8
2026-08-08
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains…
CVE-2026-16957LOWCVSS 2.7EG 2.7
2026-08-09
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including pr…
CVE-2026-16979MEDIUMCVSS 4.3EG 4.3
2026-08-19
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts b…
CVE-2026-16981MEDIUMCVSS 5.3EG 5.3
2026-08-05
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attack…
CVE-2026-17018MEDIUMCVSS 4.9EG 4.9
2026-08-10
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and …
CVE-2026-17020MEDIUMCVSS 4.3EG 4.3
2026-08-10
The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including …
CVE-2026-1704MEDIUMCVSS 4.3EG 4.3
2026-03-13
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the `get_item_permission…
CVE-2026-17059MEDIUMCVSS 6.5EG 6.5
2026-07-24
A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has p…
CVE-2026-1733MEDIUMCVSS 4.3EG 4.3
2026-02-01
A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3. This affects the function detail/tidyOrder of the file /api/store_integral/order/detail/:uni. The manipulation of the argument order_id leads to improper authorization. The at…
CVE-2026-17349CRITICALCVSS 9.6EG 9.6
2026-07-31
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including use…
CVE-2026-17527HIGHCVSS 7.7EG 7.7
2026-07-27
In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone aut…
CVE-2026-1753MEDIUMCVSS 6.8EG 6.8
2026-03-11
The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register).
CVE-2026-17531MEDIUMCVSS 5.0EG 5.0
2026-07-27
A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authoriz…
CVE-2026-17562MEDIUMCVSS 6.5EG 6.5
2026-08-27
Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0.
CVE-2026-17567MEDIUMCVSS 5.3EG 5.3
2026-07-31
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter…
CVE-2026-17570MEDIUMCVSS 4.3EG 4.3
2026-07-27
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : * Devolutions Serv…
CVE-2026-17627HIGHCVSS 7.1EG 7.1
2026-09-04
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.
CVE-2026-18028LOWCVSS 2.3EG 2.3
2026-07-28
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration …
CVE-2026-18121MEDIUMCVSS 6.3EG 6.3
2026-09-10
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lightbox endpoint (/ccm/calendar/view_event/{bID}/{occurrence_id}) does not verify that the caller is permitted to view the calendar…
CVE-2026-18200MEDIUMCVSS 4.3EG 4.3
2026-08-10
The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details…
CVE-2026-18258HIGHCVSS 8.8EG 8.8
2026-08-06
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content …
CVE-2026-18275MEDIUMCVSS 6.5EG 6.5
2026-08-06
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their…
CVE-2026-18315CRITICALCVSS 9.8EG 9.8
2026-08-19
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the …
CVE-2026-18423LOWCVSS 2.1EG 2.1
2026-09-15
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could the…
CVE-2026-18441MEDIUMCVSS 4.3EG 4.3
2026-09-17
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the set_customer_object due to missi…
CVE-2026-18620HIGHCVSS 7.1EG 7.1
2026-08-10
A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun …

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →