Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-639 (通过用户控制密钥绕过授权机制) — Vulnerability Class 1033

1033 vulnerabilities classified as CWE-639 (通过用户控制密钥绕过授权机制). AI Chinese analysis included.

CVE IDTitleCVSSSeverityPublished
CVE-2026-4330 Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter — Blog2Social: Social Media Auto Post & Scheduler 4.3 Medium2026-04-08
CVE-2026-5167 Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint — Masteriyo LMS – Online Course Builder for eLearning, LMS & Education 5.3 Medium2026-04-08
CVE-2026-39374 Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint — plane 6.5 Medium2026-04-07
CVE-2026-39354 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask — scoold 6.5 Medium2026-04-07
CVE-2026-39331 ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families — CRM 8.1 High2026-04-07
CVE-2026-39384 FreeScout Customer Merge Cross-Mailbox Authorization Bypass — freescout 7.6 High2026-04-07
CVE-2026-35489 Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` — recipes 7.3 High2026-04-07
CVE-2026-5465 Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter — Booking for Appointments and Events Calendar – Amelia 8.8 High2026-04-07
CVE-2026-35183 Brave CMS has an Insecure Direct Object Reference in Article Image Deletion — BraveCMS-2.0 7.1 High2026-04-06
CVE-2026-35173 Chyrp Lite has an IDOR via Mass Assignment in Post Model — chyrp-lite 6.5 Medium2026-04-06
CVE-2026-35045 Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification — recipes 8.1 High2026-04-06
CVE-2026-4896 WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation — WCFM – Frontend Manager for WooCommerce 8.1 High2026-04-04
CVE-2026-25197 Gardyn Cloud API Authorization Bypass Through User-Controlled Key — Cloud API 9.1 Critical2026-04-03
CVE-2026-28736 Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) — Focalboard 4.3 Medium2026-04-03
CVE-2026-34832 Scoold: Cross-Account Feedback Deletion (IDOR) — scoold 6.5 Medium2026-04-02
CVE-2026-34584 listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment) — listmonk 5.4 Medium2026-04-02
CVE-2026-5326 SourceCodester Leave Application System User Information index.php authorization — Leave Application System 5.3 Medium2026-04-02
CVE-2026-5246 Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization — Mongoose 5.6 Medium2026-04-02
CVE-2026-5199 Cross Namespace Access via Batch Operation — temporal 7.5AIHighAI2026-04-01
CVE-2026-3139 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor 4.3 Medium2026-03-31
CVE-2026-32976 OpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands — OpenClaw 6.5 Medium2026-03-31
CVE-2026-4400 Multiple vulnerabilities in 1millionbot Millie chatbot — Millie chat 6.5 -2026-03-31
CVE-2026-3321 Authorization Bypass in ON24 Q&A chat — ON24 Q&A chat 7.5 -2026-03-30
CVE-2026-3124 Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id' — Download Monitor 7.5 High2026-03-30
CVE-2026-34046 Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check — langflow 8.2 -2026-03-27
CVE-2026-4958 OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization — XAgent 3.1 Low2026-03-27
CVE-2026-33764 AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions — AVideo 4.3 Medium2026-03-27
CVE-2026-1496 Coverity CLI Authentication Bypass — Coverity 9.8 -2026-03-27
CVE-2026-33730 Open Source Point of Sale has an IDOR in Password Change (Home) — opensourcepos 6.5 Medium2026-03-27
CVE-2026-29071 Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories — open-webui 3.1 Low2026-03-26

Vulnerabilities classified as CWE-639 (通过用户控制密钥绕过授权机制) represent 1033 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.