Authorization Bypass Through User-Controlled Key
CWE-639
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system. For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.
We track 1,128 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- Architecture and Design Implementation: Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
- Architecture and Design: Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
Latest Authorization Bypass Through User-Controlled Key vulnerabilities
- 8.8 High severity
School Management System – WPSchoolPress: Authorization Bypass Through User-Controlled Key
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.10. This is due to the plugin not properly validating a user's identity prior to updating the
- 9.8 Critical severity
Radar: Authorization Bypass Through User-Controlled Key
A vulnerability was found in wfh45678 Radar up to 1.0.8 and classified as critical. This issue affects some unknown processing of the component Interface Handler. The manipulation with the input /../ leads to authorization bypass. The attack may be initiated r
- 9.8 Critical severity
Timetics – Appointment Booking & Scheduling: Authorization Bypass Through User-Controlled Key
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save() d
- 9.8 Critical severity
Miniorange OTP Verification with Firebase: Authorization Bypass Through User-Controlled Key
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorizati
- 8.8 High severity
Co-Authors, Multiple Authors and Guest Authors…: Authorization Bypass Through User-Controlled Key
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Insecure Direct Object Reference to Privilege Escalation/Account Takeover in all versions up to, and including, 4.7.1 via the ac
- 7.7 High severity
3DSwymer: Authorization Bypass Through User-Controlled Key
An authorization bypass through user-controlled key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an authenticated attacker to access some unauthorized data.
- 9.1 Critical severity
Acronis Cyber Protect 16: Authorization Bypass Through User-Controlled Key
Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
- 8.8 High severity
AuthPress: Authorization Bypass Through User-Controlled Key
The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated
- 8.8 High severity
Salon booking system: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Dimitri Grassi Salon booking system salon-booking-system.This issue affects Salon booking system: from n/a through <= 10.9.
- 8.8 High severity
WCFM – Frontend Manager for WooCommerce: Authorization Bypass Through User-Controlled Key
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFM_Customers_Manage_Controller::proce
- 9.8 Critical severity
REST API TO MiniProgram: Authorization Bypass Through User-Controlled Key
The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what u
- 9.8 Critical severity
Charitable – Donation Plugin for WordPress –…: Authorization Bypass Through User-Controlled Key
The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identi
- 7.5 High severity
next.js: Authorization Bypass Through User-Controlled Key
Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafte
- 7.5 High severity
Powermail: Authorization Bypass Through User-Controlled Key
An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference (IDOR) in some configurations. An unauthenticated attacker can use this to d
- 7.5 High severity
secure_authentication_server: Authorization Bypass Through User-Controlled Key
An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authenticat
- 7.5 High severity
SoliClub: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.
- 7.5 High severity
SoliClub: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data. This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.
- 9.8 Critical severity
SO Planning: Authorization Bypass Through User-Controlled Key
An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporti
- 10.0 Critical severity
Industrial Edge Management Pro: Authorization Bypass Through User-Controlled Key
A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1). Affected components do not properly validate the device tokens. This could allow an unauthenticated rem
- 8.8 High severity
ForumWP – Forum & Discussion Board: Authorization Bypass Through User-Controlled Key
The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the submit_form_handler due to missing validation on the 'user_id' use
- 7.5 High severity
Accord ORS: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data. This issue affects Accord ORS: before 7.3.2.1.
- 9.8 Critical severity
WP-Recall – Registration, Profile, Commerce &…: Authorization Bypass Through User-Controlled Key
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order
- 7.1 High severity
Zephyr Project Manager: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.
- 9.8 Critical severity
Zephyr Project Manager: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.
- 7.5 High severity
Stripe Payments For WooCommerce by Checkout: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Checkout Plugins Stripe Payments For WooCommerce by Checkout.This issue affects Stripe Payments For WooCommerce by Checkout: from n/a through 1.9.1.
- 8.8 High severity
WP Job Portal: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affects WP Job Portal: from n/a through <= 2.1.8.
- 8.1 High severity
Masteriyo - LMS: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.
- 9.8 Critical severity
friendica: Authorization Bypass Through User-Controlled Key
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature.
- 8.1 High severity
GitLab: Authorization Bypass Through User-Controlled Key
A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.
- 9.6 Critical severity
Apinizer Management Console: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in PruvaSoft Informatics Apinizer Management Console allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Apinizer Management Console: before 2024.05.1.
- 8.1 High severity
nato_nci_anet: Authorization Bypass Through User-Controlled Key
NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report (that belongs to an arbitrary user).
- 8.8 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation.
- 8.8 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation.
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete the services of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation.
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} allows a low privileged user to fetch, modify or delete the settings of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a high privileged user (admin). This results in unauthorized access and unauthorized data manipulation.
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary). This results in unauthorized access and unauthorized data manipulation.
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (including admin). This results in unauthorized access and unauthorized data manipulation.