CWE-639 · 3.155 kayıt
Kullanıcı kontrollü anahtarla yetki atlatma
Neden olur?
Uç nokta kaydı istekte gelen kimlikle getiriyor, ama kaydın isteyen kullanıcıya ait olup olmadığını sormuyor.
Nasıl önlenir?
- 01Her sorguya oturumdaki kullanıcıyı koşul olarak ekleyin.
- 02Sahiplik kontrolünü tek bir yetkilendirme katmanında toplayın.
- 03İki farklı hesapla karşılıklı erişim testleri yazın.
Hatalı ve düzeltilmiş kod
Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.
Hatalı
const invoice = await Invoice.findById(req.params.id);
res.json(invoice);Düzeltilmiş
const invoice = await Invoice.findOne({
id: req.params.id,
ownerId: req.user.id,
});
if (!invoice) return res.sendStatus(404);
res.json(invoice);Kodunuzda bu kalıp var mı?
Web ve API sızma testi kapsamında bu sınıfı özellikle arıyoruz. Bulgular satır numarasıyla teslim edilir.
Bu sınıftaki CVE’ler
3.173 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
66Bu hafta | CVE-2023-6875Silahlaştırılmış | POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app APIwpexperts · post smtp · CWE-639 | Kritik9,8 | — | %90,3 | 11 Oca 2024 |
63Bu hafta | CVE-2026-55255Silahlaştırılmış | Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flowlangflow · langflow · CWE-639 | Yüksek8,4 | KEV | %0,8 | 23 Haz 2026 |
60Bu hafta | CVE-2025-2563Silahlaştırılmış | User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalationwpeverest · user registration \& membership · CWE-639 | Yüksek8,1 | — | %49,0 | 14 Nis 2025 |
56Planlayın | CVE-2021-45428Kavram kanıtı | TLR-2005KSH is affected by an incorrect access control vulnerability.telesquare · tlr-2005ksh firmware · CWE-639 | Kritik9,8 | — | %56,9 | 3 Oca 2022 |
52Planlayın | CVE-2019-17382Kavram kanıtı | An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4.zabbix · zabbix · CWE-639 | Kritik9,1 | — | %53,2 | 9 Eki 2019 |
48Planlayın | CVE-2024-46982Kavram kanıtı | Cache Poisoning in next.jsvercel · next.js · CWE-639 | Yüksek7,5 | — | %59,1 | 17 Eyl 2024 |
46Planlayın | CVE-2019-13360Kavram kanıtı | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging kcontrol-webpanel · webpanel · CWE-639 | Kritik9,8 | — | %24,4 | 16 Tem 2019 |
44Planlayın | CVE-2024-0264İstismar yok | SourceCodester Clinic Queuing System LoginRegistration.php authorizationoretnom23 · clinic queuing system · CWE-639 | Kritik9,8 | — | %18,2 | 7 Oca 2024 |
43Planlayın | CVE-2022-22832Kavram kanıtı | An issue was discovered in Servisnet Tessa 0.0.2.servisnet · tessa · CWE-639 | Kritik9,8 | — | %14,0 | 6 Şub 2022 |
41Planlayın | CVE-2025-3605Kavram kanıtı | Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeoverarkenon · login, registration and lost password blocks · CWE-639 | Kritik9,8 | — | %7,8 | 9 May 2025 |
40Planlayın | CVE-2019-13605Kavram kanıtı | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process bycontrol-webpanel · webpanel · CWE-639 | Yüksek8,8 | — | %15,0 | 16 Tem 2019 |
40Planlayın | CVE-2019-6716Kavram kanıtı | An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a rlogonbox · nervepoint access manager · CWE-639 | Kritik9,4 | — | %9,6 | 21 Mar 2019 |
40Planlayın | CVE-2019-25487İstismar yok | SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmdsapido · rb-1732 · CWE-639 | Kritik9,3 | — | %8,9 | 11 Mar 2026 |
40Planlayın | CVE-2025-5947Kavram kanıtı | Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookieaonetheme · service finder bookings · CWE-639 | Kritik9,8 | — | %4,8 | 1 Ağu 2025 |
40Planlayın | CVE-2022-31692Kavram kanıtı | Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or includvmware · spring security · CWE-639 | Kritik9,8 | — | %4,2 | 31 Eki 2022 |
40Planlayın | CVE-2026-18315Kavram kanıtı | TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameterthemetechmount · truebooker – appointment booking and scheduler system · CWE-639 | Kritik9,8 | — | %3,0 | 19 Ağu 2026 |
40Planlayın | CVE-2020-11658İstismar yok | CA API Developer Portal 4.3.1 and earlier handles shared secret keys in an insecure manner, which allows attackers to bypass authorization.broadcom · ca api developer portal · CWE-639 | Kritik9,8 | — | %2,3 | 15 Nis 2020 |
40Planlayın | CVE-2024-50483Kavram kanıtı | WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerabilitytareqhasan · meetup · CWE-639 | Kritik9,8 | — | %2,3 | 28 Eki 2024 |
40Planlayın | CVE-2022-0691İstismar yok | Authorization Bypass Through User-Controlled Key in unshiftio/url-parseurl-parse project · url-parse · CWE-639 | Kritik9,8 | — | %2,2 | 21 Şub 2022 |
40Planlayın | CVE-2019-9756İstismar yok | An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, gitlab · gitlab · CWE-639 | Kritik9,8 | — | %2,1 | 17 Nis 2019 |
40Planlayın | CVE-2019-12866İstismar yok | An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack.jetbrains · youtrack · CWE-639 | Kritik9,8 | — | %1,9 | 3 Tem 2019 |
40Planlayın | CVE-2025-14998Kavram kanıtı | Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeoverwpmudev · branda – white label & branding, free login page customizer · CWE-639 | Kritik9,8 | — | %1,8 | 1 Oca 2026 |
40Planlayın | CVE-2026-69865İstismar yok | Microsoft Container Registry Elevation of Privilege Vulnerabilitymicrosoft · azure container registry · CWE-639 | Kritik10,0 | — | %0,7 | 17 Eyl 2026 |
40Planlayın | CVE-2026-83711İstismar yok | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerabilitymicrosoft · azure active directory b2c · CWE-639 | Kritik10,0 | — | %0,7 | 3 Eyl 2026 |
40Planlayın | CVE-2024-45032İstismar yok | A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versisiemens · industrial edge management pro · CWE-639 | Kritik10,0 | — | %0,7 | 10 Eyl 2024 |
- CVE-2023-687566Bu hafta
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
KritikCVSS 9,8SilahlaştırılmışEPSS %90wpexperts · post smtp11 Oca 2024
- CVE-2026-5525563Bu hafta
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
YüksekCVSS 8,4KEVSilahlaştırılmışEPSS %0langflow · langflow23 Haz 2026
- CVE-2025-256360Bu hafta
User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation
YüksekCVSS 8,1SilahlaştırılmışEPSS %49wpeverest · user registration \& membership14 Nis 2025
- CVE-2021-4542856Planlayın
TLR-2005KSH is affected by an incorrect access control vulnerability.
KritikCVSS 9,8Kavram kanıtıEPSS %56telesquare · tlr-2005ksh firmware3 Oca 2022
- CVE-2019-1738252Planlayın
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4.
KritikCVSS 9,1Kavram kanıtıEPSS %53zabbix · zabbix9 Eki 2019
- CVE-2024-4698248Planlayın
Cache Poisoning in next.js
YüksekCVSS 7,5Kavram kanıtıEPSS %59vercel · next.js17 Eyl 2024
- CVE-2019-1336046Planlayın
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging k
KritikCVSS 9,8Kavram kanıtıEPSS %24control-webpanel · webpanel16 Tem 2019
- CVE-2024-026444Planlayın
SourceCodester Clinic Queuing System LoginRegistration.php authorization
KritikCVSS 9,8İstismar yokEPSS %18oretnom23 · clinic queuing system7 Oca 2024
- CVE-2022-2283243Planlayın
An issue was discovered in Servisnet Tessa 0.0.2.
KritikCVSS 9,8Kavram kanıtıEPSS %14servisnet · tessa6 Şub 2022
- CVE-2025-360541Planlayın
Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover
KritikCVSS 9,8Kavram kanıtıEPSS %7arkenon · login, registration and lost password blocks9 May 2025
- CVE-2019-1360540Planlayın
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by
YüksekCVSS 8,8Kavram kanıtıEPSS %15control-webpanel · webpanel16 Tem 2019
- CVE-2019-671640Planlayın
An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a r
KritikCVSS 9,4Kavram kanıtıEPSS %9logonbox · nervepoint access manager21 Mar 2019
- CVE-2019-2548740Planlayın
SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmd
KritikCVSS 9,3İstismar yokEPSS %8sapido · rb-173211 Mar 2026
- CVE-2025-594740Planlayın
Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie
KritikCVSS 9,8Kavram kanıtıEPSS %4aonetheme · service finder bookings1 Ağu 2025
- CVE-2022-3169240Planlayın
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or includ
KritikCVSS 9,8Kavram kanıtıEPSS %4vmware · spring security31 Eki 2022
- CVE-2026-1831540Planlayın
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
KritikCVSS 9,8Kavram kanıtıEPSS %3themetechmount · truebooker – appointment booking and scheduler system19 Ağu 2026
- CVE-2020-1165840Planlayın
CA API Developer Portal 4.3.1 and earlier handles shared secret keys in an insecure manner, which allows attackers to bypass authorization.
KritikCVSS 9,8İstismar yokEPSS %2broadcom · ca api developer portal15 Nis 2020
- CVE-2024-5048340Planlayın
WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %2tareqhasan · meetup28 Eki 2024
- CVE-2022-069140Planlayın
Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
KritikCVSS 9,8İstismar yokEPSS %2url-parse project · url-parse21 Şub 2022
- CVE-2019-975640Planlayın
An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6,
KritikCVSS 9,8İstismar yokEPSS %2gitlab · gitlab17 Nis 2019
- CVE-2019-1286640Planlayın
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack.
KritikCVSS 9,8İstismar yokEPSS %1jetbrains · youtrack3 Tem 2019
- CVE-2025-1499840Planlayın
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover
KritikCVSS 9,8Kavram kanıtıEPSS %1wpmudev · branda – white label & branding, free login page customizer1 Oca 2026
- CVE-2026-6986540Planlayın
Microsoft Container Registry Elevation of Privilege Vulnerability
KritikCVSS 10,0İstismar yokEPSS %0microsoft · azure container registry17 Eyl 2026
- CVE-2026-8371140Planlayın
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
KritikCVSS 10,0İstismar yokEPSS %0microsoft · azure active directory b2c3 Eyl 2026
- CVE-2024-4503240Planlayın
A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versi
KritikCVSS 10,0İstismar yokEPSS %0siemens · industrial edge management pro10 Eyl 2024