CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- syauqi collegetivityAn Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui...8.1 High
- openml frontendThe openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling…3.5 Low
- sistemas pleno gestão de locaçãoSistemas Pleno Gestão de Locação CPF validarCpf authorization6.9 Medium
- danny-avila danny-avila/librechat, librechat +1 moreAuthorization Bypass due to Incorrect Access Control in danny-avila/librechat5.3 Medium
- anadolu hayat emeklilik inc. ahe mobileIDOR in Anadolu Hayat Emeklilik's AHE Mobile6.5 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP allows users to add a note to a different virtual instance5.3 Medium
- kodezen llc academy lmsWordPress Academy LMS Plugin <= 3.3.4 - Insecure Direct Object References (IDOR) Vulnerability5.5 Medium
- sayful islam upcoming events listsWordPress Upcoming Events Lists Plugin <= 1.4.0 - Insecure Direct Object References (IDOR) Vulnerability5.4 Medium
- alex content maskWordPress Content Mask plugin <= 1.8.5.3 - Insecure Direct Object References (IDOR) vulnerability3.8 Low
- proliz computer software hardware service trade ltd. co. obs (student affairs information system)IDOR in Proliz Software's OBS6.5 Medium
- webkul qloappsWebkul QloApps CSRF Token authorization6.9 Medium
- mattermost, mattermost server +1 moreIDOR in board file download allows any user to download any file by UUID3.1 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Contacts Center widget has insecure direct object reference6.9 Medium
- bimser solution software trade inc. eba document and workflow management systemIDOR in Bimser's eBA Document and Workflow Management System6.4 Medium
- wisdomgarden tronclassWisdomGarden｜Tronclass - Insecure Direct Object Reference5.3 Medium
- aonetheme service finder bookingsService Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business9.8 Critical
- prasunsen chained quizChained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie5.3 Medium
- sechard information technologies sechardIDOR in SecHard Information Technologies' SecHard5.3 Medium
- patika global technologies humansuiteIDOR in Patika Global Technologies' HumanSuite6.5 Medium
- beefull energy technologies appIDOR in Beefull Energy Technologies' Beefull App6.5 Medium
- argus technology inc. bilgerIDOR in ArgusTech's BILGER6.5 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass7.4 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name5.3 Medium
- cern indicoIndico may disclose unauthorized user details access via legacy API4.3 Medium
- pixel prime resideo plugin for resideo - real estate wordpress themeResideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover8.8 High
- dasinfomedia wpgym - wordpress gym management systemWPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover8.8 High
- dreamstechnologies doccureDoccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change9.8 Critical
- No product listedAn Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4...8.8 High
- tomdever wpforo forumWordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability4.3 Medium
- akinsoft myrezztaIDOR in Akinsoft's MyRezzta6.8 Medium
- macrozheng mallmacrozheng mall paySuccess authorization5.3 Medium
- macrozheng mallmacrozheng mall cancelUserOrder cancelOrder authorization5.3 Medium
- akinsoft prokuaforIDOR in Akinsoft's ProKuafor4.7 Medium
- akinsoft octocloudIDOR in Akinsoft's OctoCloud4.7 Medium
- phpgurukul employee leave management systemPHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference ...4.3 Medium
- github enterprise serverIncorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access7.0 High
- system pdv project pdvAn issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash...9.8 Critical
- equalize digital accessibility checker by equalize digitalWordPress Accessibility Checker by Equalize Digital Plugin <= 1.30.0 - Insecure Direct Object References (IDOR) Vulnerability5.4 Medium
- reolinkAn Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows...6.5 Medium
- jishenghua jsherpIncorrect access control in the component \controller\ResourceController.java of jshERP v3.5...8.8 High
- xuxueli xxl-jobXuxueli xxl-job Jobs JobInfoController.java remove resource injection5.3 Medium
- xuxueli xxl-jobXuxueli xxl-job JobLogController.java getJobsByGroup resource injection5.3 Medium
- pik online yazılım çözümleri a.ş. onlineIDOR in PozitifIK's Pik Online7.5 High
- wptasker wp discord post plus – supports unlimited channelsWordPress WP Discord Post Plus – Supports Unlimited Channels plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability5.3 Medium
- paymayapg maya businessWordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability7.5 High
- dogukanurker flaskblogflaskBlog arbitrary comment delete6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to Insecure Direct Object Reference4.8 Medium
- stylemix motorsWordPress Motors Plugin plugin <= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability5.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab6.5 Medium
- servicenow ai platformBroken Access Control in ServiceNow AI Platform5.3 Medium
- Show moreLoading…