Authorization Bypass Through User-Controlled Key

Property	Value
Language
Severity
CWE	CWE-639: Authorization Bypass Through User-Controlled Key
OWASP	A05:2017 - Broken Access Control
Confidence Level	Medium
Impact Level	High
Likelihood Level	Medium

Description

User-controlled input (like params or cookies) is being passed directly to model find methods without scoping to the current user. This allows attackers to access records they shouldn’t be able to see by simply changing the record ID.

Impact

If exploited, an attacker could read or manipulate sensitive records belonging to other users by guessing or iterating through IDs. This could expose personal, financial, or confidential information, leading to data breaches and loss of user trust.