CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- rometheme rtmkitWordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- No product listedInsecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform...5.0 Medium
- honeywell s35 thermal camera, s35 3m/5m/8m/pinhole/kit camera, s35 ai fisheye&dual sensor/micro dome/full color eyeball&bullet camera +2 moreInadequate access control measure allows unauthorized users to access restricted administrative functions6.8 Medium
- bdtask pharmacy management system, pharmacare +1 moreBdtask Pharmacy Management System User Profile edit_user authorization5.3 Medium
- code-projects client details systemcode-projects Client Details System authorization5.3 Medium
- learnhouseLearnHouse Student Assignment Submission sub_file resource injection5.3 Medium
- naviga global / miles 33 gn4 publishing systemGN4 Publishing System Insecure Direct Object Reference (IDOR) Information Disclosure8.6 High
- devolutions serverImproper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and...9.0 Critical
- favethemes houzezWordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- codebangers all in one time clock lite – tracking employee time has never been easierAll in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out4.3 Medium
- wpdesk flexible refund and return order for woocommerceFlexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund4.3 Medium
- No product listedMoodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object...4.3 Medium
- vhs electronic software ltd. co. ace centerIDOR in VHS Electronic Software's ACE Center5.5 Medium
- optimole – optimize images in real timeImage optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload4.3 Medium
- wpclever wpc smart quick view for woocommerceWPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure5.3 Medium
- stellarwp event tickets and registrationEvent Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass7.5 High
- letscms binary mlm planBinary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3 Medium
- strapiStrapi Allows Unauthorized Access to Private Fields via parms.lookup8.2 High
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data6.5 Medium
- sergestec exitoInsecure direct object reference (IDOR) vulnerability in Sergestec's Exito7.1 High
- dreamstechnologies truelysell coreTruelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change9.8 Critical
- kybernetikservices quick featured imagesQuick Featured Images <= 13.7.2 - Insecure Direct Object Reference to Image Manipulation4.3 Medium
- siemens sipass integratedA vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server...5.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay is Vulnerable to Authorization Bypass Through User-Controlled Key5.3 Medium
- liferay dxp, digital experience platform +1 moreLiferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled Key5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Publications vulnerable to Authorization Bypass Through User-Controlled Key4.8 Medium
- akin software computer import export industry and trade co. ltd. qrmenuIDOR in Akınsoft QRMenu7.5 High
- hcl software unica centralized offer managementHCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR)4.2 Medium
- wpclever wpc smart wishlist for woocommerceWPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation5.3 Medium
- usta information systems inc. aybs interaktifIDOR in Usta Information Systems' Aybs Interaktif6.1 Medium
- confidential-containers trusteeTrustee's attestation-policy endpoint is not protected by admin autentication8.7 High
- pebas lisfinity core - lisfinity core plugin used for pebas® lisfinity wordpress themeLisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- dell powerscale onefsDell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user...4.4 Medium
- bbmri-eric negotiatorMúltiples vulnerabilidades en Negotiator de BBMRI-ERIC5.3 Medium
- logo software inc. cloudIDOR in Logo Software's Logo Cloud6.0 Medium
- zhuimengshaonian wisdom-educationzhuimengshaonian wisdom-education WrongBookController.java authorization5.3 Medium
- poscube hardware software and consulting ltd. co. assistHard-coded Credentials in PosCube's Assist6.3 Medium
- discourseDiscourse AI Suggestions Contain Insecure Direct Object Reference4.3 Medium
- No product listedIMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list...4.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Vulnerable to IDOR via audit events5.3 Medium
- boldworkplanner bold workplannerInsecure Direct Object Reference in GPS BOLD Workplanner7.1 High
- boldworkplanner bold workplannerInsecure Direct Object Reference in GPS BOLD Workplanner7.1 High
- boldworkplanner bold workplannerInsecure Direct Object Reference in GPS BOLD Workplanner7.1 High
- boldworkplanner bold workplannerInsecure Direct Object Reference in GPS BOLD Workplanner7.1 High
- boldworkplanner bold workplannerInsecure Direct Object Reference in GPS BOLD Workplanner7.1 High
- boldworkplanner bold workplannerInsecure Direct Object Reference in GPS BOLD Workplanner7.1 High
- boldworkplanner bold workplannerInsecure Direct Object Reference in GPS BOLD Workplanner7.1 High
- boldworkplanner bold workplannerInsecure Direct Object Reference in GPS BOLD Workplanner7.1 High
- boldworkplanner bold workplannerInsecure Direct Object Reference in GPS BOLD Workplanner7.1 High
- Show moreLoading…