CWE-639: Insecure Direct Object Reference vulnerabilities

Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts.

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.

IBM DataStage on Cloud Pak for Data version 5.4.0.0 contains an authorization bypass vulnerability (CWE-639) that allows a remote authenticated attacker to manipulate runtime caches, potentially causing denial of service. The vulnerability arises from insecure direct object references. It has a high severity with a CVSS score of 7.4. No patch information is currently provided.

IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match.

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an authorization bypass vulnerability in the File/Read File component. An authenticated attacker with low privileges can exploit this flaw by supplying crafted file paths to access files belonging to other users. This occurs because the application does not properly verify ownership of storage paths when executing flows via the /api/v1/run/advanced/{flow_id} endpoint. The vulnerability allows unauthorized disclosure of sensitive user data without impacting data integrity or availability.

CVE-2026-80354 is an authorization bypass vulnerability in Apache Camel K affecting versions from 2.0.0 before 2.9.3 and from 2.10.1 before 2.10.2. The flaw allows tenants to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components. The issue is fixed in versions 2.9.3, 2.10.2, and 2.11.0.

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier.

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.

IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5 and 3.33.1 through 3.33.3 contain an authorization bypass vulnerability. This flaw arises from improper mapping of untrusted URL query parameters, allowing attackers to bypass authorization controls. The vulnerability is identified as CWE-639, related to authorization bypass through user-controlled keys. It has a high severity with a CVSS score of 7.4.

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.

Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.

CVE-2026-86489 is an Insecure Direct Object Reference (IDOR) vulnerability in JetBrains YouTrack versions before 2026.2.18634. It affects the user profile API, allowing unauthorized disclosure of private issues and starred folders across organizations. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No known exploits are reported in the wild. JetBrains has not provided explicit patch information in the input data.