CVE-2023-32669 MEDIUM

CVE-2023-32669: Authorization Bypass on BuddyBoss

Vendor Buddyboss

Product BuddyBoss

Weakness CWE-639 · IDOR

Published October 3, 2023

Last update September 6, 2024

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id).

Key dates

02Disclosure timeline

October 3, 2023 CVE published

September 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-32669 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2025-3853 WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation CVE-2025-14459 Virt-cdi-controller: unauthorized pvc cloning via dataimportcron CVE-2026-41947 Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints CVE-2024-11915 RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Post Disclosure CVE-2025-68997 WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability