CWE-639 · Authorization Bypass Through User-Controlled Key (page 11)
Page 11 of 23 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25564 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not… |
CVE-2026-25563 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not… |
CVE-2026-25757 | Medium | 5.3 | 2026-02-06 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view complet… |
CVE-2026-25758 | High | 7.5 | 2026-02-06 | Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows… |
CVE-2026-25574 | Medium | 5.4 | 2026-02-06 | Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability… |
CVE-2026-24776 | Medium | 4.3 | 2026-02-06 | OpenProject is an open-source, web-based project management software. Prior to 17.0.2, the drag&drop handler moving an agenda item to a different section was n… |
CVE-2026-2010 | Medium | 4.2 | 2026-02-06 | A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/public… |
CVE-2026-1228 | Medium | 4.3 | 2026-02-06 | The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress is vulnerable to Insecure Direct Object Re… |
CVE-2026-1271 | Medium | 5.3 | 2026-02-05 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu… |
CVE-2026-24773 | High | 7.5 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an Insecure Direct Object Reference (ID… |
CVE-2026-24991 | Medium | 5.3 | 2026-02-03 | Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Acc… |
CVE-2026-1664 | | 2026-02-03 | Summary An Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare Agents SDK. The issue… | |
CVE-2026-1375 | High | 8.1 | 2026-02-03 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and… |
CVE-2026-0909 | Medium | 5.3 | 2026-02-03 | The WP ULike plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.8.3.1. This is due to the `wp_ulike… |
CVE-2025-69207 | Medium | 5.4 | 2026-02-02 | Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notio… |
CVE-2026-1733 | Medium | 4.3 | 2026-02-01 | A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3. This affects the function detail/tidyOrder of the file /api/store_integral/order/detail/:uni. T… |
CVE-2026-1251 | Medium | 5.4 | 2026-01-31 | The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… |
CVE-2025-36365 | Medium | 6.8 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage… |
CVE-2020-37008 | High | 7.5 | 2026-01-29 | EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user in… |
CVE-2025-7013 | Medium | 5.7 | 2026-01-29 | Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers. This i… |
CVE-2025-65887 | Medium | 6.5 | 2026-01-28 | A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input… |
CVE-2026-1389 | Medium | 4.3 | 2026-01-28 | The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to… |
CVE-2026-24134 | Medium | 6.5 | 2026-01-28 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOL… |
CVE-2026-1213 | Medium | 4.3 | 2026-01-27 | All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other applicat… |
CVE-2026-21721 | High | 8.1 | 2026-01-27 | The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permi… |
CVE-2025-9520 | Medium | 6.8 | 2026-01-26 | An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owne… |
CVE-2025-14459 | High | 8.5 | 2026-01-26 | A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized names… |
CVE-2026-24136 | High | 7.5 | 2026-01-24 | Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Re… |
CVE-2026-24634 | Medium | 5.3 | 2026-01-23 | Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access… |
CVE-2026-24631 | Medium | 5.4 | 2026-01-23 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-24599 | Medium | 5.3 | 2026-01-23 | Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Config… |
CVE-2026-20912 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be… |
CVE-2026-20904 | Medium | 6.5 | 2026-01-22 | Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other us… |
CVE-2026-20897 | Critical | 9.1 | 2026-01-22 | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks b… |
CVE-2026-1201 | | 2026-01-22 | An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a rem… | |
CVE-2026-24379 | Medium | 6.5 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-22430 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22426 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-22411 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22409 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-22407 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-22406 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22404 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-22400 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-22398 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-22396 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-22393 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-22391 | Medium | 5.4 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-47555 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-65098 | High | 7.4 | 2026-01-22 | Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any… |
CVE-2025-10855 | High | 7.5 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows Exploitation of Trusted Identifiers. Th… |
CVE-2025-10024 | High | 7.5 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Education Management System allows Parameter In… |
CVE-2026-23964 | Medium | 6.5 | 2026-01-22 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in… |
CVE-2026-23754 | High | 8.8 | 2026-01-21 | D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an ar… |
CVE-2025-15521 | Critical | 9.8 | 2026-01-21 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all v… |
CVE-2026-23844 | Medium | 4.3 | 2026-01-19 | Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create accou… |
CVE-2026-23843 | High | 7.1 | 2026-01-19 | teklifolustur_app is a web-based PHP application that allows users to create, manage, and track quotes for their clients. Prior to commit dd082a134a225b8dcd401… |
CVE-2026-23522 | Low | 3.7 | 2026-01-19 | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticate… |
CVE-2025-14844 | High | 8.2 | 2026-01-16 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp… |
CVE-2025-15370 | Medium | 4.3 | 2026-01-16 | The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2025-64516 | High | 7.5 | 2026-01-15 | GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (tick… |
CVE-2025-68492 | Medium | 4.2 | 2026-01-14 | Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be… |
CVE-2026-23478 | Critical | 9.8 | 2026-01-13 | Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gai… |
CVE-2025-40805 | Critical | 10.0 | 2026-01-13 | Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent… |
CVE-2023-36331 | High | 8.2 | 2026-01-12 | Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the q… |
CVE-2026-22050 | Medium | 4.3 | 2026-01-12 | ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a vulnerability which could allow a privi… |
CVE-2025-41077 | High | 8.1 | 2026-01-12 | IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access… |
CVE-2025-69274 | High | 8.8 | 2026-01-12 | Authorization Bypass Through User-Controlled Key vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Privilege Escalation.This issue affects… |
CVE-2026-22589 | High | 7.5 | 2026-01-10 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Obj… |
CVE-2025-13457 | High | 7.5 | 2026-01-10 | The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_… |
CVE-2026-21409 | Medium | 5.9 | 2026-01-09 | Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communication between the a… |
CVE-2026-22588 | Medium | 6.5 | 2026-01-08 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Objec… |
CVE-2026-22235 | High | 7.5 | 2026-01-08 | OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber… |
CVE-2026-22234 | Critical | 9.8 | 2026-01-08 | OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable value… |
CVE-2026-22489 | Medium | 4.3 | 2026-01-08 | Authorization Bypass Through User-Controlled Key vulnerability in Wptexture Image Slider Slideshow image-slider-slideshow allows Exploiting Incorrectly Configu… |
CVE-2025-4596 | | 2026-01-08 | Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of G… | |
CVE-2025-67919 | Medium | 6.5 | 2026-01-08 | Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-15018 | Critical | 9.8 | 2026-01-07 | The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to… |
CVE-2025-14802 | Medium | 5.4 | 2026-01-07 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v… |
CVE-2025-12030 | Medium | 4.3 | 2026-01-07 | The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insuffic… |
CVE-2020-36923 | Critical | 9.8 | 2026-01-06 | Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers… |
CVE-2025-15001 | Critical | 9.8 | 2026-01-06 | The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This… |
CVE-2025-14996 | Critical | 9.8 | 2026-01-06 | The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and i… |
CVE-2025-68044 | High | 8.6 | 2026-01-05 | Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorr… |
CVE-2026-21447 | High | 7.1 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder… |
CVE-2025-14998 | Critical | 9.8 | 2026-01-02 | The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plu… |
CVE-2025-49352 | Medium | 4.3 | 2025-12-31 | Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows… |
CVE-2025-49334 | Medium | 5.3 | 2025-12-31 | Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-63053 | Medium | 5.3 | 2025-12-31 | Authorization Bypass Through User-Controlled Key vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Exploiting Incorrectly Configur… |
CVE-2025-69032 | Medium | 5.4 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-69030 | Medium | 5.4 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Acc… |
CVE-2025-69029 | Medium | 5.4 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-68997 | Medium | 5.3 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-68979 | Medium | 5.3 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Co… |
CVE-2025-68975 | Medium | 4.3 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-68502 | Medium | 4.3 | 2025-12-29 | Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-69202 | Medium | 6.5 | 2025-12-29 | Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-c… |
CVE-2025-15106 | Medium | 6.3 | 2025-12-27 | A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the com… |
CVE-2019-25235 | Critical | 9.8 | 2025-12-24 | Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disablin… |
CVE-2018-25129 | High | 7.5 | 2025-12-24 | SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitive user credentials… |