CWE-639

High likelihood

Authorization Bypass Through User-Controlled Key

Parent: CWE-863 - Incorrect Authorization

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

1,796 vulnerabilities with CWE-639
CVE-2025-9081 LOW
Mattermost <10.5.8, <9.11.17 - Info Disclosure
CVSS 3.1
CVE-2025-43803 MEDIUM
Liferay Digital Experience Platform - Insecure Direct Object Reference in Contacts Center Widget
CVSS 4.3
CVE-2025-8532 MEDIUM
Bimser Solution Software Trade Inc. EBA Document and Workflow Manag...
CVSS 6.4
CVE-2025-10719 MEDIUM
Tronclass < 1.74 - Insecure Direct Object Reference via Parameter Manipulation
CVSS 4.3
CVE-2025-5948 CRITICAL
Service Finder Bookings <6.0 - Privilege Escalation
CVSS 9.8
CVE-2025-10493 MEDIUM
Chained Quiz <1.3.4 - Insecure Direct Object Reference
CVSS 5.3
CVE-2025-8463 MEDIUM
SecHard <3.6.2-20250805 - Auth Bypass
CVSS 5.3
CVE-2025-8057 MEDIUM
Patika Global Technologies HumanSuite <53.21.0 - Auth Bypass
CVSS 6.5
CVE-2025-7355 MEDIUM
Beefull App <24.07.2025 - Auth Bypass
CVSS 6.5
CVE-2025-5518 MEDIUM
ArgusTech BILGER <2.4.6 - Auth Bypass
CVSS 6.5
CVE-2025-43790 HIGH
Liferay Portal 7.4.0-7.4.3.124 and DXP 2024.Q1.1-2024.Q1.12 - Authenticated Insecure Direct Object Reference
CVSS 8.1
CVE-2025-43782 MEDIUM
Liferay Portal 7.4.0-7.4.3.124 & DXP 2024.Q1.1-2024.Q1.12 - IDOR via Workflow Definition API
CVSS 4.3
CVE-2025-59034 MEDIUM
Indico < 3.3.8 - Unauthenticated User Profile Information Disclosure via Legacy API
CVSS 4.3
CVE-2025-7718 HIGH
Resideo Plugin <2.5.4 - Privilege Escalation
CVSS 8.8
CVE-2025-7049 HIGH
WordPress Gym Management System <= 67.7.0 - Authenticated Privilege Escalation
CVSS 8.8
CVE-2025-52389 HIGH
Envasadora H2O Eireli - Soda Cristal v40.20.4 - Info Disclosure
CVSS 8.8
CVE-2025-9114 CRITICAL
Doccure theme <1.4.8 - Privilege Escalation
CVSS 9.8
CVE-2025-58597 MEDIUM
Tomdever wpForo Forum <2.4.6 - Auth Bypass
CVSS 4.3
CVE-2025-22422 HIGH
Android - Authorization Bypass via Misleading Authentication Prompt
CVSS 7.8
CVE-2025-9836 MEDIUM
macrozheng mall < 1.0.3 - Authorization Bypass via Order ID Manipulation
CVSS 4.3
CVE-2025-9835 MEDIUM
macrozheng mall < 1.0.3 - Authorization Bypass via Order Cancellation
CVSS 4.3
CVE-2025-0670 MEDIUM
Akinsoft ProKuafor <1.02.08 - Auth Bypass
CVSS 4.7
CVE-2025-56254 MEDIUM
PHPGurukul Employee Leave Management System 2.1 - Authenticated Insecure Direct Object Reference via leaveid Parameter
CVSS 4.3
CVE-2025-0640 MEDIUM
Akinsoft OctoCloud <1.11.01 - Auth Bypass
CVSS 4.7
CVE-2025-8447 LOW
GitHub Enterprise Server < 3.14.17 - Unauthorized Repository Code Access via Diff Functionality
CVSS 3.1
Details
Vulnerabilities 1,796
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits