CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

3,652 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 48 of 74

CVE-2026-119751MEDIUMCVSS 5.3EG 5.3
2026-11-05
Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content…
CVE-2026-122326MEDIUMCVSS 5.3EG 5.3
2026-11-05
Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a s…
CVE-2026-121938MEDIUMCVSS 5.3EG 5.3
2026-11-04
langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /c…
CVE-2026-105605MEDIUMCVSS 5.3EG 5.3
2026-11-02
Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by i…
CVE-2026-63401MEDIUMCVSS 5.3EG 5.3
2026-10-30
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated …
CVE-2026-107868MEDIUMCVSS 5.3EG 5.3
2026-10-30
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.
CVE-2026-55561MEDIUMCVSS 5.3EG 5.3
2026-10-28
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` a…
CVE-2026-101273MEDIUMCVSS 5.3EG 5.3
2026-10-28
Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and the…
CVE-2026-117562MEDIUMCVSS 5.3EG 5.3
2026-10-27
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset …
CVE-2026-116810MEDIUMCVSS 5.3EG 5.3
2026-10-26
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests wi…
CVE-2026-116746MEDIUMCVSS 5.3EG 5.3
2026-10-26
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly …
CVE-2026-97255MEDIUMCVSS 5.3EG 5.3
2026-10-26
Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from…
CVE-2026-100142MEDIUMCVSS 5.3EG 5.3
2026-10-22
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored addre…
CVE-2026-114392MEDIUMCVSS 5.3EG 5.3
2026-10-21
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's …
CVE-2026-111596MEDIUMCVSS 5.3EG 5.3
2026-10-21
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billin…
CVE-2026-107789MEDIUMCVSS 5.3EG 5.3
2026-10-21
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, a…
CVE-2026-114091MEDIUMCVSS 5.3EG 5.3
2026-10-21
Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendly…
CVE-2026-112068MEDIUMCVSS 5.3EG 5.3
2026-10-20
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
CVE-2026-94229MEDIUMCVSS 5.3EG 5.3
2026-10-19
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal informa…
CVE-2026-111902MEDIUMCVSS 5.3EG 5.3
2026-10-17
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language he…
CVE-2026-111707MEDIUMCVSS 5.3EG 5.3
2026-10-16
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to…
CVE-2026-111620MEDIUMCVSS 5.3EG 5.3
2026-10-16
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream n…
CVE-2026-111324MEDIUMCVSS 5.3EG 5.3
2026-10-15
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, u…
CVE-2026-110774MEDIUMCVSS 5.3EG 5.3
2026-10-14
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored fil…
CVE-2026-110764MEDIUMCVSS 5.3EG 5.3
2026-10-14
AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can en…
CVE-2026-96900MEDIUMCVSS 5.3EG 5.3
2026-10-14
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who k…
CVE-2026-94261MEDIUMCVSS 5.3EG 5.3
2026-10-14
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transac…
CVE-2026-106166MEDIUMCVSS 5.3EG 5.3
2026-10-14
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or ap…
CVE-2026-107652MEDIUMCVSS 5.3EG 5.3
2026-10-14
The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_…
CVE-2026-108862MEDIUMCVSS 5.3EG 5.3
2026-10-11
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view perm…
CVE-2026-108724MEDIUMCVSS 5.3EG 5.3
2026-10-11
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers…
CVE-2026-108596MEDIUMCVSS 5.3EG 5.3
2026-10-10
OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id…
CVE-2026-105893MEDIUMCVSS 5.3EG 5.3
2026-10-08
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.
CVE-2026-105198MEDIUMCVSS 5.3EG 5.3
2026-10-08
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retr…
CVE-2026-84169MEDIUMCVSS 5.3EG 5.3
2026-10-05
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary ord…
CVE-2026-104118MEDIUMCVSS 5.3EG 5.3
2026-10-04
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitra…
CVE-2026-104403MEDIUMCVSS 5.3EG 5.3
2026-10-02
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9.
CVE-2026-94405MEDIUMCVSS 5.3EG 5.3
2026-10-02
Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71.
CVE-2026-94432MEDIUMCVSS 5.3EG 5.3
2026-10-02
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_ord…
CVE-2026-62061MEDIUMCVSS 5.3EG 5.3
2026-10-01
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid…
CVE-2026-96173MEDIUMCVSS 5.3EG 5.3
2026-10-01
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an …
CVE-2026-103476MEDIUMCVSS 5.3EG 5.3
2026-09-30
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identi…
CVE-2026-97259MEDIUMCVSS 5.3EG 5.3
2026-09-30
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: fro…
CVE-2026-97282MEDIUMCVSS 5.3EG 5.3
2026-09-30
Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.
CVE-2026-97078MEDIUMCVSS 5.3EG 5.3
2026-09-30
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
CVE-2026-97066MEDIUMCVSS 5.3EG 5.3
2026-09-30
Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
CVE-2026-94673MEDIUMCVSS 5.3EG 5.3
2026-09-30
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
CVE-2026-101112MEDIUMCVSS 5.3EG 5.3
2026-09-29
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifi…
CVE-2026-90907MEDIUMCVSS 5.3EG 5.3
2026-09-29
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-leve…
CVE-2026-92436MEDIUMCVSS 5.3EG 5.3
2026-09-27
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unaut…

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →