CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- classroomio ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint 6.0 Medium
- open-emr openemr OpenEMR before 8.3.0 Broken Access Control via portal_payment.php 7.1 High
- open-emr openemr OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents API 7.1 High
- open-emr openemr OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launch 7.1 High
- open-emr openemr OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments 7.1 High
- open-emr openemr OpenEMR before 8.3.0 IDOR via form_pid in portal/lib/paylib.php 7.1 High
- open-emr openemr OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patient 7.1 High
- open-emr openemr OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API 7.1 High
- open-emr openemr OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.php 8.6 High
- open-emr openemr OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists 7.1 High
- open-emr openemr OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via QuestionnaireResponse 7.1 High
- open-emr openemr OpenEMR before 8.3.0 Patient Portal IDOR via Case-Sensitive Pid Parameter 7.1 High
- open-emr openemr OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientController 7.1 High
- open-emr openemr OpenEMR before 8.3.0 Cross-Patient IDOR via Encounter Form Viewers and Save Handlers 8.6 High
- open-emr openemr OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignment 7.1 High
- open-emr openemr OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.php 7.1 High
- open-emr openemr OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIR 6.0 Medium
- open-emr openemr OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routes 7.1 High
- open-emr openemr OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint 8.6 High
- unknown secure custom fields Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR 2.7 Low
- unknown antom payments Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data Disclosure 5.3 Medium
- unknown event tickets manager for woocommerce Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII Disclosure 6.5 Medium
- go-vikunja vikunja Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook 7.1 High
- go-vikunja vikunja Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move 5.3 Medium
- go-vikunja vikunja Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion 5.3 Medium
- crocoblock jetformbuilder – hierarchical select WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability 5.3 Medium
- funnelkit payment gateway for stripe woocommerce, teamfunnelkit funnelkit payment gateway for stripe woocommerce +1 more FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter 7.5 High
- unknown directorist: ai-powered business directory, listings & classified ads Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR 4.3 Medium
- unknown directorist: ai-powered business directory, listings & classified ads Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt 4.3 Medium
- unknown directorist: ai-powered business directory, listings & classified ads Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR 4.3 Medium
- unknown advanced custom fields (acf®) Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR 2.7 Low
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.0 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.8 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 6.3 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.5 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.5 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.0 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 5.0 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.1 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.5 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.1 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.1 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 6.5 Medium
- Show olderLoading…