CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- classroomioInsecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and...7.5 High
- classroomioAn Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access...4.3 Medium
- better-auth passkeybetter-auth passkey before 1.4.0 IDOR via delete-passkey7.1 High
- nmedia frontend file manager pluginFrontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming4.3 Medium
- nmedia admin and customer messages after order for woocommerce: orderconvoAdmin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure5.3 Medium
- themehunk wishlist for woocommerceWishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation6.5 Medium
- nmedia admin and customer messages after order for woocommerce: orderconvoAdmin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages4.3 Medium
- phpgurukul online shopping portalInsecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping...4.3 Medium
- primakon project contract managementPrimakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered...5.3 Medium
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'4.3 Medium
- wpswings return refund and exchange for woocommerceReturn Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read5.4 Medium
- wpswings return refund and exchange for woocommerceReturn Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation4.3 Medium
- revive adserver, revive-adserver revive adserver +1 moreMissing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users...7.1 High
- lukevella ralllyRallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId8.1 High
- lukevella ralllyRallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation8.1 High
- lukevella ralllyRallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names6.5 Medium
- lukevella ralllyRallly Improper Authorization in Comment Endpoint Allows User Impersonation6.5 Medium
- lukevella ralllyRallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal7.1 High
- lukevella ralllyRallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants8.1 High
- lukevella ralllyRallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)9.1 Critical
- lukevella ralllyRallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)6.5 Medium
- lukevella ralllyRallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes6.5 Medium
- blackberry athoc, blackberry® athoc® (onprem) +1 moreInsecure Direct Object Reference (IDOR) vulnerability in the Management Console of affected versions of BlackBerry AtHoc.5.0 Medium
- yith woocommerce wishlist, yithemes yith woocommerce wishlist +1 moreYITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename5.3 Medium
- johnjamesjacoby post type switcherPost Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change5.4 Medium
- kishan0725 hospital management systemkishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR)...6.5 Medium
- optimus software brokerage automation2FA Expiry Bypass in Optimus Software's Brokerage Automation8.1 High
- alteryx serverWhen processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object...5.4 Medium
- typebot, baptistearno typebot.io +1 moreTypebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure5.0 Medium
- t-innova deporsite dsuite 2025Insecure Direct Object References (IDOR) in DeporSite of T-Innova DeporSite5.3 Medium
- softaculous page builder: pagelayer – drag and drop website builderPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference4.3 Medium
- filebrowserFileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function7.2 High
- mrclayton payment plugins braintree for woocommercePayment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud7.5 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment4.3 Medium
- acowebs wishlist and save for later for woocommerceWishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion4.3 Medium
- ryanmoyer the total book projectThe Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation5.4 Medium
- softivus wislyWisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation5.3 Medium
- evershopEverShop Order Order.resolvers.js resource injection6.3 Medium
- yungifez skuul, skuul school management system +1 moreyungifez Skuul School Management System View Fee Invoice fee-invoices resource injection2.3 Low
- itthinx groupsGroups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join4.3 Medium
- getwpfunnels wpfunnels – funnel builder for woocommerce with checkout & one click upsellWPFunnels <= 3.6.2 - Unauthorized User Registration5.3 Medium
- No product listednewbee-mall-plus seckillExecution executeSeckill authorization6.3 Medium
- kamleshyadav miraculous core pluginWordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerability9.8 Critical
- zitadelIDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering8.7 High
- diaowen dwsurveyDWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire,...7.5 High
- cfmoto rideIDOR vulnerability in the CFMOTO RIDE API8.5 High
- cb project ltd. co. cvlandIDOR in CB Project's CVLand9.9 Critical
- fushengqian fuintfushengqian fuint Authentication Token ClientSignController.java authorization2.3 Low
- aonetheme service finder bookingsService Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover8.8 High
- aonetheme service finder bookingsService Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password8.8 High
- Show moreLoading…