CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- yamldotnet project yamldotnetHigh severity vulnerability that affects YamlDotNet and YamlDotNet.Signed7.8 High
- vaultize enterprise file sharingAn issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper...5.3 Medium
- hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User...5.7 Medium
- gitlab, gitlab community and enterprise editions +1 moreGitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an...4.3 Medium
- gitlab, gitlab community and enterprise editions +1 moreGitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the...7.5 High
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a...4.3 Medium
- kanboardIn Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a...4.3 Medium
- gitlabMultiple versions of GitLab expose sensitive user credentials when assigning a user to an issue...6.3 Medium
- apache rangerApache Ranger allows users to bypass intended access restrictions via direct access to module URLs7.1 High
- ec-cube co.,ltd. ec-cube, s‑cubism inc. ec-orange +1 moreEC-CUBE vulnerable to authorization bypass5.0 Medium
- openstack essex, folsom, red hat openstack essex for rhel 6 +5 more +7 moreOpenstack keystone: openstack keystone: authorization bypass via improper ec2 token handling5.4 Medium