CWE-639: Authorization bypass through a user-controlled key (IDOR)

CVEs per yearBy the year they were published

1. 20121
2. 201715
3. 201812
4. 201947
5. 202048
6. 202177
7. 2022132
8. 2023142
9. 2024292
10. 2025422
11. 20262,285

Known exploitedNewest addition to KEV first

• CVE-2026-55255

  Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

  langflow-ai · langflow

  ExploitedHigh8.4

Newest CVEs

• CVE-2026-124551

  ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint

  classroomio · classroomio

  Medium6.0
• CVE-2026-124489

  OpenEMR before 8.3.0 Broken Access Control via portal_payment.php

  openemr · openemr

  High7.1
• CVE-2026-124485

  OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents API

  openemr · openemr

  High7.1
• CVE-2026-124482

  OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launch

  openemr · openemr

  High7.1
• CVE-2026-124481

  OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments

  openemr · openemr

  High7.1
• CVE-2026-124476

  OpenEMR before 8.3.0 IDOR via form_pid in portal/lib/paylib.php

  openemr · openemr

  High7.1
• CVE-2026-124475

  OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patient

  openemr · openemr

  High7.1
• CVE-2026-124473

  OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API

  openemr · openemr

  High7.1
• CVE-2026-124471

  OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.php

  openemr · openemr

  High8.6
• CVE-2026-124470

  OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists

  openemr · openemr

  High7.1

Vendors it comes up for most

1. IBM58
2. Red Hat39
3. openemr37
4. GitLab36
5. Apache Software Foundation29
6. Growatt26
7. Nextcloud25
8. open-webui23
9. makeplane21
10. Microsoft19