CWE-639 · Authorization Bypass Through User-Controlled Key (page 13)
Page 13 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4630 | Medium | 6.8 | 2026-05-19 | A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Prot… |
CVE-2026-37978 | Medium | 4.9 | 2026-05-19 | A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints… |
CVE-2026-46721 | | 2026-05-19 | The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a… | |
CVE-2026-33052 | | 2026-05-19 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_t… | |
CVE-2026-41949 | Medium | 5.9 | 2026-05-18 | Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 c… |
CVE-2026-41947 | Critical | 9.1 | 2026-05-18 | Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any… |
CVE-2026-8786 | Medium | 6.3 | 2026-05-18 | A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/ha… |
CVE-2026-45666 | Medium | 6.5 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the API /api/v1/notes/{note_id} endpoint la… |
CVE-2026-44570 | High | 8.3 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, authorization controls surrounding the memo… |
CVE-2026-45402 | High | 8.1 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, multiple endpoints accept a user-supplied fi… |
CVE-2026-45398 | High | 7.5 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, _validate_collection_access() checks the use… |
CVE-2026-45386 | Medium | 4.3 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, Pin/Unpin is a write operation (modifies the… |
CVE-2026-45385 | Medium | 4.3 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, an IDOR vulnerability exists in the Channels… |
CVE-2026-45671 | High | 8.0 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user can permanently delet… |
CVE-2026-45349 | High | 7.1 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /… |
CVE-2026-46408 | High | 7.6 | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-… |
CVE-2026-46407 | High | 8.1 | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint… |
CVE-2026-44718 | | 2026-05-15 | Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, explorations.get, exploration… | |
CVE-2026-44678 | | 2026-05-14 | Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} e… | |
CVE-2026-8629 | High | 8.1 | 2026-05-14 | Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-only access to obtain Code, WebVNC, and Egress… |
CVE-2026-44544 | | 2026-05-14 | gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf's Reference State Log (RSL) can roll back the curren… | |
CVE-2026-42572 | Medium | 5.3 | 2026-05-14 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the… |
CVE-2026-44504 | | 2026-05-14 | Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulnerable to a cross-tena… | |
CVE-2025-15025 | High | 8.8 | 2026-05-14 | Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade… |
CVE-2026-6008 | Medium | 6.8 | 2026-05-14 | Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd… |
CVE-2026-5798 | | 2026-05-14 | Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘em… | |
CVE-2025-12008 | High | 8.8 | 2026-05-14 | Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc. Yaay Social Media App allows Accessing Functionality N… |
CVE-2026-2347 | Critical | 9.8 | 2026-05-14 | Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking. … |
CVE-2026-6206 | Medium | 5.3 | 2026-05-14 | The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystri… |
CVE-2026-5395 | High | 8.2 | 2026-05-14 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Referen… |
CVE-2026-6063 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain… |
CVE-2026-5396 | High | 8.2 | 2026-05-14 | The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 6.1.21. This is d… |
CVE-2026-3074 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-3073 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-1338 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have… |
CVE-2025-13874 | Medium | 4.3 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-7648 | Medium | 4.3 | 2026-05-14 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to payment bypass through user-controlled key in al… |
CVE-2026-44426 | Medium | 6.5 | 2026-05-13 | ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e… |
CVE-2026-44424 | Medium | 6.5 | 2026-05-13 | ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without veri… |
CVE-2026-44423 | Medium | 6.5 | 2026-05-13 | ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by… |
CVE-2026-42463 | High | 8.1 | 2026-05-13 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Obj… |
CVE-2026-6965 | Medium | 5.3 | 2026-05-13 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9… |
CVE-2025-14033 | Medium | 5.3 | 2026-05-13 | The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_tick… |
CVE-2026-44341 | Medium | 5.3 | 2026-05-12 | GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by dire… |
CVE-2026-42889 | Critical | 9.1 | 2026-05-12 | Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endp… |
CVE-2026-29204 | Critical | 9.1 | 2026-05-12 | Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownersh… |
CVE-2023-30059 | Medium | 5.4 | 2026-05-12 | An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado para… |
CVE-2026-6001 | High | 8.8 | 2026-05-12 | Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers. This issue affec… |
CVE-2026-43890 | High | 7.7 | 2026-05-11 | Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.7.0, the subscriptions.create API endpoint in server/routes/api/subscription… |
CVE-2026-43883 | Medium | 4.2 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreemen… |
CVE-2026-38568 | High | 8.1 | 2026-05-11 | HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/<id> and /interview/<id>… |
CVE-2026-33356 | High | 7.7 | 2026-05-11 | In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive teleme… |
CVE-2026-42609 | High | 8.1 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user c… |
CVE-2026-8196 | Low | 3.7 | 2026-05-09 | A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/… |
CVE-2026-42456 | Medium | 4.3 | 2026-05-08 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, GET /api/w… |
CVE-2026-42291 | Medium | 6.8 | 2026-05-08 | SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and creating sharing lin… |
CVE-2026-42205 | High | 8.8 | 2026-05-08 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsC… |
CVE-2026-44400 | High | 8.1 | 2026-05-08 | MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass… |
CVE-2026-42279 | Medium | 5.8 | 2026-05-08 | solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bou… |
CVE-2026-42278 | | 2026-05-08 | UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of SmartTransferTx contains a critical logic… | |
CVE-2026-42277 | Medium | 6.5 | 2026-05-08 | Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the GET /chat/file/{file_id} endpoint allows any authenticated user to download… |
CVE-2026-42276 | Medium | 4.3 | 2026-05-08 | Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_session_id} endpoint lets any authenticat… |
CVE-2026-41906 | High | 7.1 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-s… |
CVE-2026-27329 | Medium | 5.3 | 2026-05-07 | Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-40981 | High | 7.5 | 2026-05-07 | When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secret… |
CVE-2026-20219 | Medium | 5.4 | 2026-05-06 | A vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote attacker to access the social profile data of other users or affect… |
CVE-2026-8027 | Medium | 4.3 | 2026-05-06 | A weakness has been identified in FlowiseAI Flowise up to 3.0.12. Affected by this vulnerability is an unknown functionality of the component User Controller H… |
CVE-2026-7573 | Medium | 5.0 | 2026-05-06 | An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authenticated low-privilege u… |
CVE-2026-41950 | Medium | 6.5 | 2026-05-05 | Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other… |
CVE-2026-3454 | Medium | 6.5 | 2026-05-05 | The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0. This is due to missing o… |
CVE-2026-2729 | Medium | 5.3 | 2026-05-05 | The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0. This is due to the plugin not properly… |
CVE-2026-7782 | Medium | 6.3 | 2026-05-04 | A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the file application/controllers/Clients.php o… |
CVE-2026-42227 | Medium | 6.5 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with a valid API key scoped to variab… |
CVE-2026-41471 | High | 7.5 | 2026-05-04 | The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that… |
CVE-2026-29200 | | 2026-05-04 | A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant a… | |
CVE-2026-7702 | Medium | 5.3 | 2026-05-03 | A vulnerability was detected in toeverything AFFiNE up to 0.26.3. This issue affects the function allowDocPreview of the file /workspace/:workspaceId/:docId of… |
CVE-2026-5337 | Medium | 6.5 | 2026-05-03 | During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Refere… |
CVE-2026-7681 | Medium | 6.5 | 2026-05-03 | A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backe… |
CVE-2026-2554 | High | 8.1 | 2026-05-02 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2026-7491 | High | 8.1 | 2026-05-02 | School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify a specific parameter t… |
CVE-2026-7638 | Medium | 5.3 | 2026-05-02 | The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to… |
CVE-2026-7510 | Medium | 6.3 | 2026-04-30 | A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagemen… |
CVE-2026-7502 | Medium | 5.4 | 2026-04-30 | A security vulnerability has been detected in LinkStackOrg LinkStack up to 4.8.6. The affected element is the function saveLink of the file app/Http/Controller… |
CVE-2026-6542 | Medium | 6.5 | 2026-04-30 | IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to other users, and to d… |
CVE-2026-4503 | High | 7.5 | 2026-04-30 | IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a… |
CVE-2026-40600 | High | 8.1 | 2026-04-30 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew allo… |
CVE-2026-7399 | High | 8.1 | 2026-04-30 | Authorization bypass through User-Controlled key vulnerability in MeWare Software Development Inc. PDKS allows Privilege Abuse. This issue affects PDKS: from… |
CVE-2026-42517 | | 2026-04-29 | This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attacker could exploit this… | |
CVE-2026-42516 | | 2026-04-29 | This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability… | |
CVE-2026-42515 | | 2026-04-29 | This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability… | |
CVE-2026-41649 | High | 7.7 | 2026-04-28 | Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an… |
CVE-2026-41406 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fe… |
CVE-2026-24178 | Critical | 9.8 | 2026-04-28 | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization by… |
CVE-2026-41372 | Medium | 5.8 | 2026-04-28 | OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers… |
CVE-2026-28747 | High | 7.1 | 2026-04-27 | A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed. |
CVE-2026-7145 | Medium | 5.4 | 2026-04-27 | A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitati… |
CVE-2026-7144 | Medium | 4.3 | 2026-04-27 | A security flaw has been discovered in 1000 Projects Portfolio Management System MCA 1.0. This impacts an unknown function of the file update_passwd_process.ph… |
CVE-2025-15626 | | 2026-04-27 | Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application | |
CVE-2026-6810 | Medium | 5.3 | 2026-04-24 | The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the d… |
CVE-2026-2028 | Medium | 5.3 | 2026-04-24 | The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxi_remove_cu… |