Skip to content
OpenAdvisories

Weakness (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

Base Incomplete

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

More detail

It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system.

For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.

How to prevent it (3 mitigations)

  1. Architecture and Design

    For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

  2. Architecture and Design, Implementation

    Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

  3. Architecture and Design

    Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

Source: MITRE CWE-639

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 2.7
    CVE-2026-93661 Public exploit

    Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

    The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to t…

    Web / CMS
  • Low 2.3
    CVE-2026-8347 Public exploit

    Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog

    Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog.  This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express an…

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  • Low 3.7
    CVE-2026-8196 Public exploit

    JeecgBoot mLogin Endpoint LoginController.java authorization

    A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/LoginController.java of the component mLogin Endpoint. This manipulation c…

  • Low 3.7
    CVE-2024-12483 Public exploit

    Dromara UJCMS User ID id authorization

    A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack r…

    dromara UJCMS