CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key
The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
A kind of CWE-639 Insecure Direct Object Reference / IDOR.
From the CWE List. © The MITRE Corporation.
Newest
- mailwatch MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail 8.1 High
- jenkins In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from... 8.8 High
- citeum opencti OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities 6.5 Medium
- database software training consulting ltd. databank accreditation software SQLi in Database Software's Databank Accreditation Software 9.8 Critical
- citeum opencti GraphQL IDOR allows authenticated user to delete workspace content of other users 7.1 High
- esbi information and telecommunication industry and trade limited company auto service software SQLi in ESBI Informatics's Auto Service Software 9.8 Critical
- intelliants subrion cms Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool 3.8 Low
- zulip, zulip server +1 more Zulip allows the deletion of Custom profile fields by administrators of a different organization 2.7 Low
- zulip Zulip allows the deletion of organization by administrators of a different organization 2.7 Low
- bss software mobuy online machinery monitoring panel SQLi in BSS Software's Mobuy Online Machinery Monitoring Panel 10.0 Critical
- harbor SQL Injection in Harbor scan log API 2.7 Low
- ec-cube co.,ltd. ec-cube, s‑cubism inc. ec-orange +1 more EC-CUBE vulnerable to authorization bypass 5.0 Medium