Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A session was retrieved by ID and restored/bound without checking ownership. This logic allows a session hijacking attack if an attacker supplies a victim's session ID. Verify that the session owner matches the currently authenticated user before performing the binding.
Reading authenticated identifiers (like user or agent IDs) directly from gRPC incoming metadata can lead to authentication bypass or spoofing. When an upstream interceptor appends a verified identity to the metadata, client-supplied values can precede the server-appended values in the metadata slice. Handlers extracting the first value (`values[0]`) will pro
Detected an unscoped TypeORM OR condition. Passing an array to the 'where' clause or using 'orWhere' executes an OR condition in SQL. If a branch only filters by an access level (like 'personal') without also checking a user identifier, it unintentionally exposes records belonging to all users instead of just the requesting user. Ensure private data queries
Merging path parameters with query or body parameters such that path parameters serve as the base map in `Map.merge/2`. In Elixir, `Map.merge/2` overwrites keys in the first map with keys from the second map. This allows untrusted user inputs from queries or request bodies to overwrite path-extracted variables, which can lead to Authorization Bypass or Insec
Broadcasting to a PubSub topic directly constructed from unverified user input allows an attacker to inject messages into arbitrary or private topics, potentially leading to cross-session interaction, unauthorized state modification, or session hijacking. Validate the topic using `Phoenix.Token.verify/4` or check ownership against the current authenticated s
NFS filehandles are decoded using an exportfs decode function without cryptographic verification. Because standard NFS filehandles are traditionally predictable, an unauthenticated network attacker can guess them to bypass path-based access controls and access restricted files. Ensure incoming filehandles are cryptographically verified (e.g., using `fh_verif
Decoding a network-provided filehandle via `exportfs_decode_fh_raw` without cryptographic verification (e.g., checking NFSEXP_SIGN_FH and verifying a MAC). This allows predictable filehandles to be spoofed by attackers, bypassing access controls.
Detected construction of a mock file object combined with a hardcoded ownership source type during serialization/upload. Failing to conditionally associate correct ownership identities (like checking for specific module IDs) bypasses access controls and introduces Insecure Direct Object Reference (IDOR) vulnerabilities via file uploads. Set metadata dynamica
Resource action lookup uses only `get_actions`, omitting actions registered via custom controls (`get_actions_from_custom_controls`). Because two independent registration paths exist, this narrower lookup returns nil for custom-control-registered actions; the nil guard then redirects (marking `performed? == true`), causing the `verify_authorization` before-a
LuaRuntime is configured with attribute access control (attribute_filter or attribute_handlers) but register_builtins=False is not set. Python builtins accessible as python.builtins.* inside Lua — including getattr, setattr, eval, and exec — bypass the attribute filter entirely by invoking CPython natively, skipping Lupa's proxy metamethods. This allows sand
Directly mapping an 'all' parameter to `True` in a database filter can bypass authorization checks. If the application relies on this filter for access control, requesting 'all' will grant access to all records regardless of user permissions. Instead of substituting a blanket `True` clause, resolve 'all' to the specific records the user is authorized to view
An entity retrieved from a factory or repository using an ID derived from user parameters is assigned without an intermediate authorization/conditional check. This could lead to Insecure Direct Object Reference (IDOR) vulnerabilities, allowing users to associate unowned resources.
Generating a presigned URL directly from an unvalidated user input path can lead to an Insecure Direct Object Reference (IDOR). An attacker could exploit this by providing a path to another user's file or an internal system file, leading to arbitrary file disclosure. Validate the file path by mapping it to a database record owned by the authenticated user be
formGetContext() returns a value derived from the 'form_context' POST parameter, allowing authenticated users to override the server-side form rendering context. Combined with context-specific form field visibility, this lets clients coerce a more permissive context that exposes privileged fields (e.g. role_id, is_superuser, permissions) and persist arbitrar
A TypeORM query uses a logical OR condition (`where` array or `orWhere`) to fetch records generically matched as 'personal' across the entire database, bypassing user-specific constraints. This results in an Insecure Direct Object Reference (IDOR) data exposure. Ensure 'personal' queries are strictly bounded by explicitly requested owner/user constraints on
Authorization bypass (IDOR) detected. The code fetches a target object and uses the target object's properties (e.g., role or privileges) for authorization, instead of the requester's context. An attacker can bypass access controls by explicitly calling the endpoint against an object that holds the privileged role. Verify that authorization checks evaluate t
The authorization logic incorrectly checks the role of the requested target (e.g., user record) instead of the current authenticated session context. This can lead to an IDOR (Authorization Bypass) where unprivileged users can access privileged records by requesting them. Ensure that the authorization condition verifies the role of the current requesting use
Both meaningful return values from GetUserFromContext (user record and org config) are discarded via blank identifiers. Without capturing the calling principal, no object-level authorization check is possible before using caller-supplied request parameters to access protected resources, enabling IDOR (CWE-639). Capture the user record, extract the principal,
Detects an authorization or parameter validation bypass where a batch array input incorrectly takes precedence over a single ID input via short-circuiting. If an attacker provides a valid array in the request body alongside an unauthorized single targeted ID in the URL parameter, the application might validate the array but act on the targeted ID. Prioritize
A Meteor publish function aggregates items into an array without conducting an authorization check involving the user ID (e.g., `this.userId`). If this array is used to fetch related items, it can lead to Insecure Direct Object Reference (IDOR) and data leakage. Add an explicit authorization check inside the iteration loop or ensure the initial query correct
A method constructs and returns a file path using user input without verifying the resulting file against an explicit allow-list. In restricted contexts (like file shares), this can allow attackers to access unauthorized sibling files or bypass directory-level restrictions (CWE-862). Ensure that file access boundaries are enforced by validating the path agai
Detected a TypeORM query using an OR condition (via an array in `find` or `orWhere` in QueryBuilder) between a static property and a user-related property. This pattern can cause authorization bypasses if the static property was meant to distinguish private or specific types of items but lacks a tenant/user restriction (such as mistakenly doing `type: 'perso
Missing authorization check for `serverId` before calling `readConfigInPath`. This can lead to IDOR and Path Traversal if the target server doesn't belong to the active user's organization.
Missing ownership validation for locally uploaded TUS files during resource import. This allows an attacker to specify a file ID belonging to another user and import their data. Ensure that the referenced `TusFile` is validated against the current user's ID to prevent Insecure Direct Object Reference (IDOR).
