CWE-639 · Authorization Bypass Through User-Controlled Key (page 6)
Page 6 of 23 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48868 | High | 7.5 | 2026-06-15 | Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions. |
CVE-2026-40792 | Medium | 6.3 | 2026-06-15 | Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions. |
CVE-2026-39518 | High | 7.1 | 2026-06-15 | Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions. |
CVE-2025-59133 | High | 7.5 | 2026-06-15 | Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions. |
CVE-2026-12204 | High | 7.3 | 2026-06-15 | A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the… |
CVE-2026-1291 | Medium | 4.3 | 2026-06-13 | The Meow Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the REST API endpoint /wp-json/me… |
CVE-2026-54361 | | 2026-06-12 | MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegations, and shadow attributes. Several cont… | |
CVE-2026-54360 | | 2026-06-12 | A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the controller did not remove a user-suppl… | |
CVE-2026-54357 | | 2026-06-12 | An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belonging to site adminis… | |
CVE-2026-53726 | | 2026-06-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation… | |
CVE-2026-42947 | High | 8.8 | 2026-06-12 | A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary acco… |
CVE-2026-8828 | | 2026-06-12 | A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or… | |
CVE-2026-45832 | High | 8.8 | 2026-06-12 | All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass a… |
CVE-2026-45830 | High | 8.8 | 2026-06-12 | A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update… |
CVE-2026-44207 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other user… | |
CVE-2026-47238 | Medium | 6.5 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can edit another user's video subtitles beca… |
CVE-2026-47189 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up and deletes… | |
CVE-2026-7787 | High | 7.5 | 2026-06-11 | IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direc… |
CVE-2026-8406 | | 2026-06-11 | openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging mod… | |
CVE-2026-6976 | Low | 3.7 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain… |
CVE-2026-53911 | | 2026-06-11 | Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patch… | |
CVE-2023-40200 | Medium | 5.3 | 2026-06-11 | Authorization bypass through User-Controlled key vulnerability in Essential Plugin WP Logo Showcase Responsive Slider and Carousel allows Exploiting Incorrectl… |
CVE-2026-44692 | High | 7.7 | 2026-06-10 | Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes acce… |
CVE-2026-46558 | High | 8.3 | 2026-06-10 | Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read… |
CVE-2026-53471 | Critical | 9.6 | 2026-06-10 | A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAg… |
CVE-2026-53470 | Critical | 9.6 | 2026-06-10 | A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url`… |
CVE-2026-45563 | Medium | 4.3 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history/<service>/<server_ip> re-use… |
CVE-2026-45552 | Critical | 9.9 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.be… |
CVE-2026-45550 | Critical | 9.1 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PUT /smon/check (app/routes/smon/routes.p… |
CVE-2026-53675 | Medium | 4.3 | 2026-06-10 | BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate anothe… |
CVE-2026-53673 | High | 8.1 | 2026-06-10 | BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary p… |
CVE-2026-6444 | | 2026-06-09 | A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, access functionality bey… | |
CVE-2026-44083 | Critical | 9.8 | 2026-06-09 | An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability… |
CVE-2026-9185 | High | 7.5 | 2026-06-09 | The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the… |
CVE-2026-49141 | High | 7.1 | 2026-06-08 | WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify c… |
CVE-2026-46441 | Critical | 9.6 | 2026-06-08 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the… |
CVE-2026-42863 | High | 8.1 | 2026-06-08 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the… |
CVE-2026-42862 | Medium | 5.0 | 2026-06-08 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the… |
CVE-2026-42861 | Critical | 9.6 | 2026-06-08 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the… |
CVE-2026-11500 | Medium | 5.0 | 2026-06-08 | A vulnerability was identified in Weaviate up to 1.37.7. This vulnerability affects the function validateConfig of the file usecases/auth/authentication/apikey… |
CVE-2026-11461 | Medium | 6.3 | 2026-06-07 | A vulnerability has been found in NousResearch hermes-agent up to 0.12.0. This affects the function resolve_session_by_title of the file hermes_state.py of the… |
CVE-2026-9851 | High | 7.2 | 2026-06-06 | The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a… |
CVE-2026-8839 | Medium | 5.3 | 2026-06-06 | The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2… |
CVE-2026-8611 | Medium | 4.3 | 2026-06-06 | The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'in… |
CVE-2026-7665 | Medium | 5.3 | 2026-06-06 | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, an… |
CVE-2026-10038 | Medium | 4.3 | 2026-06-06 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Refer… |
CVE-2026-46390 | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to un… | |
CVE-2026-45750 | Critical | 9.0 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager… |
CVE-2026-45746 | Critical | 9.0 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager function… |
CVE-2026-45743 | High | 8.1 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to vers… |
CVE-2026-11369 | | 2026-06-05 | The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user h… | |
CVE-2026-11142 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-49192 | Medium | 5.4 | 2026-06-04 | The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scr… |
CVE-2026-10597 | Medium | 5.3 | 2026-06-04 | OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specific parameter… |
CVE-2025-14772 | High | 8.8 | 2026-06-03 | Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. |
CVE-2026-7201 | High | 8.8 | 2026-06-02 | CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x b… |
CVE-2026-24761 | Low | 3.7 | 2026-06-01 | Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allo… |
CVE-2026-24756 | Medium | 4.3 | 2026-06-01 | Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allo… |
CVE-2026-24755 | Medium | 5.4 | 2026-06-01 | Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allo… |
CVE-2026-24753 | Medium | 6.5 | 2026-06-01 | Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allo… |
CVE-2026-45810 | Medium | 6.8 | 2026-06-01 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing… |
CVE-2026-45281 | High | 8.1 | 2026-06-01 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the kn… |
CVE-2026-23638 | Medium | 6.5 | 2026-06-01 | Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allo… |
CVE-2026-45159 | Low | 3.5 | 2026-06-01 | Nextcloud is an open source content collaboration platform. From versions 1.15.0 to before 1.15.4, 1.16.0 to before 1.16.3, 1.17.0 to before 1.17.1, and 1.18.0… |
CVE-2026-45155 | Low | 2.6 | 2026-06-01 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.7 and 33.0.0 to before 33.0.1, a missing ac… |
CVE-2026-46764 | Medium | 4.3 | 2026-06-01 | The Event Log detail endpoint `GET /api/v2/eventLogs/{event_log_id}` in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Aud… |
CVE-2026-41084 | High | 7.5 | 2026-06-01 | A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the… |
CVE-2026-10212 | Medium | 6.3 | 2026-06-01 | A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_agent.py. Such manip… |
CVE-2026-10154 | Medium | 4.3 | 2026-05-31 | A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Suc… |
CVE-2026-47266 | | 2026-05-29 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or gues… | |
CVE-2026-49386 | Medium | 6.5 | 2026-05-29 | In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas |
CVE-2026-43917 | | 2026-05-29 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.19.0 and earlier, the protectedProcedure middleware only verifies the user is authenticated… | |
CVE-2026-45551 | | 2026-05-29 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.165, GroupOffice allows authenticated us… | |
CVE-2026-9493 | Medium | 6.5 | 2026-05-29 | Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modi… |
CVE-2026-47713 | Low | 2.0 | 2026-05-28 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, an approved mobile… |
CVE-2026-45342 | | 2026-05-28 | LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains an Insecure Direct Object Reference vulnerability in the authorizat… | |
CVE-2026-42999 | Medium | 6.0 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body… |
CVE-2026-45297 | | 2026-05-28 | OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case m… | |
CVE-2026-41160 | Medium | 4.3 | 2026-05-28 | EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspoCRM 9.3.3 allows l… |
CVE-2026-41141 | Medium | 6.5 | 2026-05-28 | EspoCRM is an open source customer relationship management application. Prior to 9.3.5, the POST /api/v1/EmailTemplate/:id/prepare endpoint accepts an emailAdd… |
CVE-2026-7651 | Medium | 5.3 | 2026-05-28 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin… |
CVE-2026-3173 | Medium | 6.5 | 2026-05-28 | The Meta Field Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.5.1. This is due to the plu… |
CVE-2026-9241 | Medium | 4.3 | 2026-05-28 | The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions… |
CVE-2026-9228 | Medium | 4.3 | 2026-05-28 | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4… |
CVE-2026-46544 | Medium | 5.3 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO accepts client-supplied sessio… |
CVE-2026-46414 | High | 8.8 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trus… |
CVE-2026-4868 | High | 8.2 | 2026-05-27 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that, under certain c… |
CVE-2026-38807 | High | 8.8 | 2026-05-27 | Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component |
CVE-2026-9712 | | 2026-05-27 | When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-83… | |
CVE-2026-42736 | High | 7.5 | 2026-05-27 | Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Acces… |
CVE-2026-42725 | Medium | 6.5 | 2026-05-27 | Authorization Bypass Through User-Controlled Key vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Exploi… |
CVE-2026-8890 | High | 8.2 | 2026-05-26 | code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a… |
CVE-2026-44776 | | 2026-05-26 | Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do not enforce library-level authorization… | |
CVE-2026-47716 | Low | 3.1 | 2026-05-26 | Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, but a… |
CVE-2026-47715 | Low | 3.1 | 2026-05-26 | Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions… |
CVE-2026-43934 | Medium | 6.5 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authentica… |
CVE-2026-38587 | Medium | 4.3 | 2026-05-26 | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1. The flaw exists in multiple REST API endpoints. Th… |
CVE-2026-40127 | | 2026-05-25 | OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter. Any authenticated user, can rea… | |
CVE-2026-9306 | Low | 3.7 | 2026-05-23 | A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router… |
CVE-2026-35430 | High | 8.8 | 2026-05-22 | Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a netwo… |