CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- unknown woocommerce multiple customer addresses & shipping, woocommerce multiple customer addresses \& shipping project multiple customer addresses \& shipping +1 moreWooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR8.8 High
- nilsteampassnet nilsteampassnet/teampass, teampass +1 moreAuthorization Bypass Through User-Controlled Key in nilsteampassnet/teampass6.3 Medium
- play-with-docker, play-with-docker play with docker +1 morePlay With Docker vulnerable to Authorization Bypass Through User-Controlled Key6.5 Medium
- oceanwp ocean extraOcean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure6.5 Medium
- optinmonster, unknown popup builder by optinmonster +1 morePopup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure6.5 Medium
- moodleMoodle has Incorrect Default Permissions5.3 Medium
- yf-exam project yf-examCleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed...7.5 High
- unknown user activity, user activity project activity +1 moreUser Activity <= 1.0.1 - IP Spoofing7.5 High
- unknown wp private message, apusthemes wp private messaging +1 moreWP Private Message < 1.0.6 - Private Message Disclosure via IDOR4.3 Medium
- kron tech single connectAuthorization Bypass Through User-Controlled Key on Single Connect8.8 High
- nextcloud mail, kiteworks security-advisories +1 moreIDOR Vulnerability in Nextcloud Mail4.1 Medium
- marcus (aka @msykes) wp fullcalendarWP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access5.3 Medium
- biltema baby camera firmware, ip camera firmware +1 moreInsecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software...7.5 High
- unknown aawp, getaawp amazon affiliate wordpress plugin +1 moreAAWP < 3.12.3 - Unsafe URL Handling7.5 High
- contentstudioContentStudio <= 1.2.5 - Authorization Bypass8.2 High
- alejandropascual quick restaurant menuQuick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference8.1 High
- instructure canvas learning management serviceInstructure Canvas LMS didn't properly deny access to locked/unpublished files when the...6.5 Medium
- opentext extended ecmAn issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Java...8.8 High
- lsoft listservThe LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object...7.5 High
- nextcloud deck, kiteworks security-advisories +1 moreNextcloud Deck vulnerable to authorization bypass3.5 Low
- 2code wpqa builder, unknown discy, himer +2 moreWPQA < 5.9.3 - Missing validation lead to functionality abuse3.5 Low
- unknown wp cerber security, anti-spam & malware scan, cerber wp cerber security\, anti-spam \& malware scan +1 moreWP Cerber < 9.3.3 - User Enumeration Bypass via Rest API5.3 Medium
- reputeinfosystems bookingpressBookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id5.3 Medium
- liuos project liuosLiuOS vulnerable to Authorization Bypass through User-Controlled Key9.2 Critical
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos8.6 High
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos8.3 High
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos8.2 High
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos8.1 High
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos9.1 Critical
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos8.6 High
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos8.6 High
- amentotech workreapWorkreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR6.5 Medium
- usememos memos, usememos/memos +1 moreAuthorization Bypass Through User-Controlled Key in usememos/memos8.6 High
- jegtheme jeg elementor kit, jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpress +1 moreJeg Elementor Kit <= 2.5.6 - Authorization Bypass5.4 Medium
- jegtheme jeg elementor kit, jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpress +1 moreJeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass8.6 High
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate API authorization4.3 Medium
- rsjoomla rsfirewall\!, rsjoomla! rsfirewall! +1 moreRSFirewall < 1.1.25 - IP Block Bypass9.8 Critical
- open-emr openemr, openemr openemr/openemr +1 moreAuthorization Bypass Through User-Controlled Key in openemr/openemr8.8 High
- unknown directoristDirectorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR6.5 Medium
- unknown all-in-one security (aios), updraftplus all-in-one security +1 moreAll In One WP Security & Firewall < 5.0.8 - IP Spoofing5.3 Medium
- canon vitrea viewCanon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. An...6.5 Medium
- amentotech workreapWorkreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDOR7.5 High
- algan prens student information systemIDOR in Prens Student Information System8.8 High
- standalonetech terawallet, subratamal wallet for woocommerce +1 moreTeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference4.3 Medium
- telosalliance omnia mpx node firmwareAn Insecure Direct Object Reference (IDOR) vulnerability in the password reset function of Telos...7.5 High
- awesomesupport awesome supportAwesome Support < 6.1.2 - Subscriber+ Arbitrary Exported Tickets Download6.5 Medium
- sz-fujia ourphotoThe user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from...7.5 High
- miele appwashMiele: Vulnerability in cloud service used by appWash8.1 High
- gamerz wp-pollsWP-Polls < 2.76.0 - IP Validation Bypass5.3 Medium
- gunkastudios login block ipsLogin Block IPs <= 1.0.0 - IP Spoofing Bypass7.5 High
- Show moreLoading…