CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- metaphor creations post duplicatorPost Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure4.3 Medium
- iqonic wpbookitWPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change9.8 Critical
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference4.3 Medium
- No product listedMultiple functions are vulnerable to Authorization Bypass in AIMS eCrew. The issue was fixed in...5.4 Medium
- wpjobportal wp job portal, wp job portal – ai-powered recruitment system for company or job board website +1 moreWP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3 Medium
- quanta computer qoca aimQuanta Computer QOCA aim - Authorization Bypass8.8 High
- khoj-ai khojkhoj has an IDOR in subscription management that allows unauthorized subscription modifications4.3 Medium
- teampassTeamPass privileges issue5.4 Medium
- theme-fusion avada builder, themefusion avada (fusion) builder +1 moreAvada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure4.3 Medium
- giuse content no cache | serve uncached partial content even when you add it to a page that is fully cached.Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosure5.3 Medium
- solitweb full screen menu for elementorFull Screen Menu for Elementor <= 1.0.7 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- lleidanet pki esignaPath Traversal vulnerability in eSignaViewer Allow Unauthorized File Access2.0 Low
Oqtane.FrameworkNuGet,Oqtane.ServerNuGet +1 moreOqtane Framework Insecure Direct Object Reference vulnerability6.5 MediumOqtane.ClientNuGet,Oqtane.FrameworkNuGet,Oqtane.ServerNuGet +1 more +3 moreOqtane Framework Insecure Direct Object Reference vulnerability4.3 Medium- plex media serverAuthorization bypass through user-controlled key vulnerability in streaming service in Synology...7.5 High
- nicheaddons events addon for elementorEvents Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- codeastro complaint management systemAn IDOR vulnerability in CodeAstro's Complaint Management System v1.0 (version with 0 updates)...8.8 High
- phpgurukul online notes sharing management systemAn IDOR vulnerability in the edit-notes.php module of PHPGurukul Online Notes Sharing Management...4.3 Medium
- nextgeography ng analyserIDOR in NextGEO's NG Analyser6.5 Medium
- rstheme2017 shortcodes for elementorShortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- webdeveric get post content shortcodeGet Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode4.3 Medium
- arraytics timetics – appointment booking & schedulingWP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion4.3 Medium
- collizo4sky rate my post – star rating plugin by feedbackwpRate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts5.3 Medium
- wpsoul greenshift – animation and page builder blocks, greenshiftwp greenshift - animation and page builder blocks +1 moreGreenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- element invader elementinvader addons for elementor, elementinvader addons for elementor +1 moreElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read4.3 Medium
- dromara ujcmsDromara UJCMS User ID id authorization6.3 Medium
- unifiedtransformAccess Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform4.3 Medium
- unifiedtransformObject-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform4.3 Medium
- ideaboxcreations powerpack addons for elementor (free widgets, extensions and templates)PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.8.1 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- ashraf xltab – accordions and tabs for elementor page builderXLTab – Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- wpvibes dynific addons for elementor (formerly anywhere elementor)AnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- choijun la-studio element kit for elementor, la-studio element kit for elementor +1 moreLA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- getdollie dollie ai – connectDollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- dell networkerDell NetWorker, version(s) 19.10, contain(s) an Authorization Bypass Through User-Controlled Key...8.3 High
- nicheaddons charity addon for elementorCharity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- spring securitySpring Security Authorization Bypass for Case Sensitive Comparisons4.8 Medium
- No product listedA Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to...4.8 Medium
- nicheaddons restaurant & cafe addon for elementor, restaurant \& cafe addon for elementor +1 moreRestaurant & Cafe Addon for Elementor <= 1.5.9 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- nicheaddons primary addon for elementorPrimary Addon for Elementor <= 1.6.2 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- themelooks enter addons – ultimate template builder for elementor, enter addons +1 moreEnter Addons – Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- qnap media streaming add-onMedia Streaming add-on6.9 Medium
- bplugins feeds for twitter – embed social media posts with live updatesEasy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure4.3 Medium
- bplugins button block, button block – design stylish, interactive, and multi-functional buttons +1 moreButton Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- blockswp theme builder for elementorTheme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- ifso if-so dynamic content personalizationIf-So Dynamic Content Personalization <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- codeastrology ultraaddons, codersaiful ultraaddons for elementor +1 moreUltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.8 - Insecure Direct Object Reference to Sensitive Informat…4.3 Medium
- moodleMoodle: idor when accessing list of course badges4.3 Medium
- moodleMoodle: idor when deleting oauth2 linked accounts7.5 High
- sirv image optimizer, resizer and cdn – sirv, sirv +1 moreImage Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion8.1 High
- Show moreLoading…