Authorization Bypass Through User-Controlled SQL Primary Key
CWE-566
The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8.
How this weakness is prevented
- Implementation: Modify the query to include a clause that performs an authorization check, or otherwise ensure that the check is performed before the query is executed.
- Implementation: Assume all input is malicious. Use a standard input validation mechanism to validate all input for length, type, syntax, and business rules before accepting the data. Use an accept known good validation strategy.
- Implementation: Use a parameterized query AND make sure that the accepted values conform to the business rules. Construct your SQL statement accordingly.
Latest Authorization Bypass Through User-Controlled SQL Primary Key vulnerabilities
- 8.1 High severity
MailWatch: Authorization Bypass Through User-Controlled SQL Primary Key
MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or d
- 8.8 High severity
Jenkins: Deserialization of Untrusted Data
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending o
- 8.1 High severity
opencti: Improper Authorization
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. H
- 9.8 Critical severity
Databank Accreditation Software: Authorization Bypass Through User-Controlled SQL Primary Key
Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection. This issue affects Databank Accreditation Software: before 2026/04.
- 9.1 Critical severity
opencti: Incorrect Authorization
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and investi