← Back
CWE-639

2,051 CVEs • Abstraction: Base • Likelihood of Exploit: High

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

JSON object

Loading...

CVEs (2,051)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-24136
1Saleor
1Saleor
Jun 17, 2026
Jan 24, 2026
8.7 HIGH· v4
7.5 HIGH· v3
N/A· v2
Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated acto...Show more
Saleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct Object Reference (IDOR) vulnerability that allows unauthenticated actors to extract sensitive information in plain text. Orders created before Saleor 3.2.0 could have PIIs exfiltrated. The issue has been patched in Saleor versions: 3.22.29, 3.21.45, and 3.20.110. To workaround, temporarily block non-staff users from fetching order information (the order() GraphQL query) using a WAF.Show less
CVE-2026-24634
-
-
Jun 17, 2026
Jan 23, 2026
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Reviews:...Show more
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Reviews: from n/a through <= 3.2.16.Show less
CVE-2026-24631
-
-
Jun 17, 2026
Jan 23, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rosebud: from n/a through <= 1.4.
CVE-2026-24599
-
-
Jun 17, 2026
Jan 23, 2026
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMo...Show more
Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.Show less
CVE-2026-20912
1Gitea
1Gitea
Jul 15, 2026
Jan 22, 2026
N/A· v4
9.1 CRITICAL· v3
N/A· v2
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making...Show more
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.Show less
CVE-2026-20904
1Gitea
1Gitea
Jun 17, 2026
Jan 22, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities.
CVE-2026-20897
1Gitea
1Gitea
Jul 15, 2026
Jan 22, 2026
N/A· v4
9.1 CRITICAL· v3
N/A· v2
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
CVE-2026-1201
-
-
Jun 17, 2026
Jan 22, 2026
9.4 CRITICAL· v4
N/A· v3
N/A· v2
An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside o...Show more
An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.Show less
CVE-2026-24379
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a...Show more
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.3.Show less
CVE-2026-22430
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verdure: from n/a through <= 1.6.
CVE-2026-22426
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sweet Jane: from n/a through...Show more
Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sweet Jane: from n/a through <= 1.2.Show less
CVE-2026-22411
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
3.8 LOW· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dolcino: from n/a through <= 1.6.
CVE-2026-22409
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
3.8 LOW· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justicia: from n/a through <= 1...Show more
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justicia: from n/a through <= 1.2.Show less
CVE-2026-22407
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
3.8 LOW· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Roam: from n/a through <= 2.1.1.
CVE-2026-22406
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
3.8 LOW· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through <= 1.3.
CVE-2026-22404
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
3.8 LOW· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Innovio: from n/a through <= 1.7.
CVE-2026-22400
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Holmes: from n/a through <= 1.7.
CVE-2026-22398
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fleur: from n/a through <= 2.0.
CVE-2026-22396
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fiorello: from n/a through <= 1...Show more
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fiorello: from n/a through <= 1.0.Show less
CVE-2026-22393
-
-
Jun 17, 2026
Jan 22, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Curly: from n/a through <= 3.3.