目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-639 通过用户控制密钥绕过授权机制 类漏洞列表 1664

CWE-639 通过用户控制密钥绕过授权机制 类弱点 1664 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-639 属于授权绕过漏洞，指系统依赖用户可控的键值检索数据时，未验证该键值是否属于当前请求用户。攻击者通过篡改标识符（如ID），直接访问其他用户的数据记录。开发者应避免使用直接暴露的键值，转而采用间接引用或会话上下文验证，确保每次数据访问前严格校验资源归属权，从而防止越权访问。

MITRE CWE 官方描述
CWE：CWE-639 通过用户可控密钥绕过授权（Authorization Bypass Through User-Controlled Key） 英文：系统的授权功能未能阻止用户通过修改标识数据的密钥值，从而获取其他用户的数据或记录。 系统中基于某个受用户控制的密钥值来检索用户记录。该密钥通常用于标识系统中存储的与用户相关的记录，并用于查找该记录以呈现给用户。攻击者很可能需要是系统中的已认证用户。然而，授权过程未能正确检查数据访问操作，以确保执行该操作的已认证用户拥有执行所请求数据访问的足够权限，从而绕过了系统中存在的任何其他授权检查。例如，攻击者可以查看检索特定用户数据的位置（例如搜索界面），并确定正在查找的项目的密钥是否可外部控制。该密钥可能是 HTML 表单中的隐藏字段，也可能作为 URL 参数或未加密的 Cookie 变量传递，在这些情况下，都有可能篡改密钥值。这种弱点的一种表现形式是，当系统使用顺序生成或易于猜测的会话 ID（Session IDs）时，允许一个用户轻松切换到另一个用户的会话并读取/修改其数据。
常见影响 (3)
Access Control Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
缓解措施 (3)
Architecture and Design For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Architecture and Design, Implementation Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Architecture and Design Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
代码示例 (1)
The following code uses a parameterized statement, which escapes metacharacters and prevents SQL injection vulnerabilities, to construct and execute a SQL query that searches for an invoice matching the specified identifier [1]. The identifier is selected from a list of all invoices associated with the current authenticated user.
... conn = new SqlConnection(_ConnectionString); conn.Open(); int16 id = System.Convert.ToInt16(invoiceID.Text); SqlCommand query = new SqlCommand( "SELECT * FROM invoices WHERE id = @id", conn); query.Parameters.AddWithValue("@id", id); SqlDataReader objReader = objCommand.ExecuteReader(); ...
Bad · C#
CVE ID 标题 CVSS 风险等级 Published
CVE-2025-66547 Nextcloud Server 安全漏洞 — security-advisories 4.3 Medium 2025-12-05
CVE-2025-13932 SolisCloud Monitoring Platform 安全漏洞 — Monitoring Platform (Cloud API & Device Control API) 4.3AI Medium AI 2025-12-04
CVE-2025-12997 Medtronic CareLink Network 安全漏洞 — CareLink Network 2.2 Low 2025-12-04
CVE-2025-13109 WordPress plugin HUSKY 安全漏洞 — HUSKY – Products Filter Professional for WooCommerce 4.3 Medium 2025-12-03
CVE-2025-41086 AMS Development GAMS 安全漏洞 — GAMS 8.1AI High AI 2025-12-02
CVE-2025-66306 Grav 安全漏洞 — grav 4.3 Medium 2025-12-01
CVE-2025-13615 WordPress plugin StreamTube Core 安全漏洞 — StreamTube Core 9.8 Critical 2025-11-30
CVE-2025-13768 Uniong WebITR 安全漏洞 — WebITR 7.5 High 2025-11-28
CVE-2025-13157 WordPress plugin QODE Wishlist for WooCommerce 安全漏洞 — QODE Wishlist for WooCommerce 5.3 Medium 2025-11-27
CVE-2025-13382 WordPress plugin Frontend File Manager 安全漏洞 — Frontend File Manager Plugin 4.3 Medium 2025-11-25
CVE-2025-13389 WordPress plugin Admin and Customer Messages After Order for WooCommerce: OrderConvo 安全漏洞 — Admin and Customer Messages After Order for WooCommerce: OrderConvo 5.3 Medium 2025-11-25
CVE-2025-12040 WordPress plugin Wishlist for WooCommerce 安全漏洞 — Wishlist for WooCommerce 6.5 Medium 2025-11-25
CVE-2025-13452 WordPress plugin Admin and Customer Messages After Order for WooCommerce: OrderConvo 安全漏洞 — Admin and Customer Messages After Order for WooCommerce: OrderConvo 4.3 Medium 2025-11-25
CVE-2025-10039 WordPress plugin ELEX WordPress HelpDesk & Customer Ticketing System 安全漏洞 — ELEX WordPress HelpDesk & Customer Ticketing System 4.3 Medium 2025-11-21
CVE-2025-12881 WordPress plugin Return Refund and Exchange For WooCommerce 安全漏洞 — Return Refund and Exchange For WooCommerce 5.4 Medium 2025-11-21
CVE-2025-12086 WordPress plugin Return Refund and Exchange For WooCommerce 安全漏洞 — Return Refund and Exchange For WooCommerce 4.3 Medium 2025-11-21
CVE-2025-65034 Rallly 安全漏洞 — rallly 8.1 High 2025-11-19
CVE-2025-65032 Rallly 安全漏洞 — rallly 6.5 Medium 2025-11-19
CVE-2025-12766 BlackBerry AtHoc 安全漏洞 — BlackBerry® AtHoc® (OnPrem) 5.0 Medium 2025-11-19
CVE-2025-12427 WordPress plugin YITH WooCommerce Wishlist 安全漏洞 — YITH WooCommerce Wishlist 5.3 Medium 2025-11-19
CVE-2025-12524 WordPress plugin Post Type Switcher 安全漏洞 — Post Type Switcher 5.4 Medium 2025-11-18
CVE-2025-8855 Optimus Brokerage Automation 授权问题漏洞 — Brokerage Automation 8.1 High 2025-11-14
CVE-2025-64706 Typebot 安全漏洞 — typebot.io 5.0 Medium 2025-11-13
CVE-2025-41069 T-INNOVA Deporsite 安全漏洞 — DSuite 2025 8.1 - 2025-11-13
CVE-2025-12366 WordPress plugin Page Builder: Pagelayer – Drag and Drop website builder 安全漏洞 — Page Builder: Pagelayer – Drag and Drop website builder 4.3 Medium 2025-11-13
CVE-2025-12903 WordPress plugin Payment Plugins Braintree For WooCommerce 安全漏洞 — Payment Plugins Braintree For WooCommerce 7.5 High 2025-11-12
CVE-2025-12087 WordPress plugin Wishlist and Save for later for Woocommerce 安全漏洞 — Wishlist and Save for later for Woocommerce 4.3 Medium 2025-11-12
CVE-2025-12833 WordPress plugin GeoDirectory – WP Business Directory Plugin and Classified Listings Directory 安全漏洞 — GeoDirectory – WP Business Directory Plugin and Classified Listings Directory 4.3 Medium 2025-11-12
CVE-2025-12126 WordPress plugin The Total Book Project 安全漏洞 — The Total Book Project 5.4 Medium 2025-11-11
CVE-2025-11532 WordPress plugin Wisly 安全漏洞 — Wisly 5.3 Medium 2025-11-11

CWE-639（通过用户控制密钥绕过授权机制） 是常见的弱点类别，本平台收录该类弱点关联的 1664 条 CVE 漏洞。