CWE-639

High likelihood

Authorization Bypass Through User-Controlled Key

Parent: CWE-863 - Incorrect Authorization

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

1,794 vulnerabilities with CWE-639
CVE-2025-66547 MEDIUM
Nextcloud Server <31.0.1 - Info Disclosure
CVSS 4.3
CVE-2025-66546 LOW
Nextcloud Calendar <4.7.19, 5.5.6, 6.0.1 - Info Disclosure
CVSS 3.3
CVE-2025-13932 HIGH
SolisCloud Monitoring Platform - Authenticated Insecure Direct Object Reference via Plant ID Parameter
CVE-2025-12997 LOW
Medtronic CareLink Network <Dec 4, 2025 - Info Disclosure
CVSS 2.2
CVE-2025-61148 MEDIUM
edupluscampus 3.0.1 - Authenticated Insecure Direct Object Reference via 'rec_no' Parameter
CVSS 6.5
CVE-2025-65097 MEDIUM
RomM <4.4.1-4.4.1-beta.2 - Privilege Escalation
CVSS 6.5
CVE-2025-65096 MEDIUM
RomM <4.4.1-4.4.1-beta.2 - Info Disclosure
CVSS 4.3
CVE-2025-13109 MEDIUM
HUSKY - Products Filter Professional <1.3.7.2 - Info Disclosure
CVSS 4.3
CVE-2025-12954 LOW
MotoPress WordPress <2.4.16 - Info Disclosure
CVSS 2.7
CVE-2025-41086 MEDIUM
GAMS < 48.7.0 - Unauthenticated Authorization Bypass via Insecure License Checksum
CVSS 6.5
CVE-2025-66306 MEDIUM
Grav <1.8.0-beta.27 - Info Disclosure
CVSS 4.3
CVE-2025-13615 CRITICAL
StreamTube Core <4.78 - Privilege Escalation
CVSS 9.8
CVE-2025-13768 HIGH
Uniong WebITR < 2.1.0.34 - Authenticated Authentication Bypass via User ID Parameter
CVSS 7.5
CVE-2025-13157 MEDIUM
QODE Wishlist <1.2.7 - Info Disclosure
CVSS 5.3
CVE-2025-65670 MEDIUM
classroomio <0.1.13 - Info Disclosure
CVSS 4.3
CVE-2025-65672 HIGH
classroomio <0.1.13 - Info Disclosure
CVSS 7.5
CVE-2025-65647 MEDIUM
PHPGURUKUL Online Shopping Portal 2.1 - Insecure Direct Object Reference in Track Order Function
CVSS 4.3
CVE-2025-64067 MEDIUM
Primakon Pi Portal 1.0.18 - Authorization Bypass via ID Manipulation and Filter Omission
CVSS 5.3
CVE-2025-13452 MEDIUM
WooCommerce: OrderConvo <14 - Missing Authorization
CVSS 4.3
CVE-2025-13389 MEDIUM
WooCommerce: OrderConvo <14 - Info Disclosure
CVSS 5.3
CVE-2025-13382 MEDIUM
Frontend File Manager Plugin <23.4 - Insecure Direct Object Reference
CVSS 4.3
CVE-2025-12040 MEDIUM
WooCommerce Wishlist <1.0.9 - Insecure Direct Object Reference
CVSS 6.5
CVE-2025-10039 MEDIUM
Elula Wsdesk < 3.3.0 - IDOR
CVSS 4.3
CVE-2025-12881 MEDIUM
WooCommerce <4.5.5 - Insecure Direct Object Reference
CVSS 5.4
CVE-2025-12086 MEDIUM
Return Refund & Exchange For WooCommerce <4.5.5 - Insecure Direct O...
CVSS 4.3
Details
Vulnerabilities 1,794
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits