CWE-639

High likelihood

Authorization Bypass Through User-Controlled Key

Parent: CWE-863 - Incorrect Authorization

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

1,791 vulnerabilities with CWE-639
CVE-2025-14844 HIGH
Membership Plugin - Restrict Content <= 3.2.16 - Unauthenticated Stripe SetupIntent Secret Leak
CVSS 8.2
CVE-2025-15370 MEDIUM
Shield: Blocks Bots - Insecure Direct Object Reference
CVSS 4.3
CVE-2025-64516 HIGH
GLPI 10.0.0-10.0.20 - Unauthenticated Document Access via Public FAQ
CVSS 7.5
CVE-2025-68492 MEDIUM
Chainlit < 2.8.5 - Authorization Bypass via User-Controlled Key
CVSS 4.2
CVE-2025-40805 CRITICAL
Siemens Industrial Edge Cloud Device and Device Kit - Authentication Bypass
CVSS 10.0
CVE-2025-41077 HIGH
Viafirma Inbox < 4.5.27 - Authenticated Insecure Direct Object Reference
CVSS 8.1
CVE-2025-69274 HIGH
Broadcom DX NetOps Spectrum < 24.3.11 - Privilege Escalation via Authorization Bypass
CVSS 8.8
CVE-2025-13457 HIGH
WooCommerce Square <5.1.1 - Info Disclosure
CVSS 7.5
CVE-2025-4596 MEDIUM
Asseco ADMX <6.09.01.62 - Info Disclosure
CVE-2025-67919 MEDIUM
WofficeIO Woffice Core <5.4.30 - Auth Bypass
CVSS 6.5
CVE-2025-15018 CRITICAL
WordPress Optional Email <1.3.11 - Privilege Escalation
CVSS 9.8
CVE-2025-14802 MEDIUM
LearnPress - WordPress LMS Plugin <4.3.2.2 - Info Disclosure
CVSS 5.4
CVE-2025-12030 MEDIUM
ACF to REST API <3.3.4 - Insecure Direct Object Reference
CVSS 4.3
CVE-2025-15001 CRITICAL
FS Registration Password <1.0.1 - Privilege Escalation
CVSS 9.8
CVE-2025-14996 CRITICAL
WordPress Default Registration Form <2.0.0 - Privilege Escalation
CVSS 9.8
CVE-2025-68044 HIGH
Rustaurius Five Star Restaurant Reservations <2.7.9 - Auth Bypass
CVSS 8.6
CVE-2025-14998 CRITICAL
Branda WordPress <3.4.24 - Privilege Escalation
CVSS 9.8
CVE-2025-49352 MEDIUM
YoOhw Studio Order Cancellation & Returns for WooCommerce - Auth By...
CVSS 4.3
CVE-2025-49334 MEDIUM
MyD Delivery <= 1.7.1 - Authorization Bypass Through User-Controlled Key
CVSS 5.3
CVE-2025-63053 MEDIUM
Jewel Theme Master Addons for Elementor <2.0.9.9.4 - Auth Bypass
CVSS 5.3
CVE-2025-69032 MEDIUM
FiveStar <= 1.7 - Authorization Bypass via User-Controlled Key
CVSS 5.4
CVE-2025-69030 MEDIUM
Backpack Traveler <= 2.10.3 - Authorization Bypass Through User-Controlled Key
CVSS 5.4
CVE-2025-69029 MEDIUM
Select-Themes Struktur <2.5.1 - Auth Bypass
CVSS 5.4
CVE-2025-68997 MEDIUM
wpDiscuz <= 7.6.43 - Authorization Bypass Through User-Controlled Key
CVSS 5.3
CVE-2025-68979 MEDIUM
SimpleCalendar Google Calendar Events <3.5.9 - Auth Bypass
CVSS 5.3
Details
Vulnerabilities 1,791
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits