CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- codepeople contact form emailWordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- projectsendProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability7.1 High
- ulicmsUliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability9.3 Critical
- world wide broadcast network avideoAVideo < 20.1 IDOR Arbitrary Video Rotation5.3 Medium
- world wide broadcast network avideoAVideo < 20.1 IDOR Arbitrary Comment Image Upload8.7 High
- world wide broadcast network avideoAVideo < 20.1 IDOR Arbitrary File Deletion8.7 High
- world wide broadcast network avideoAVideo < 20.1 IDOR Arbitrary File Upload8.7 High
- gg soft software services inc. paperworkIDOR in GG Soft's PaperWork7.1 High
- kstover ninja forms – the contact form builder that grows with you, ninjaforms ninja forms +1 moreNinja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token7.5 High
- pagekitPagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component9.8 Critical
- menulux software inc. mobile appIDOR in Menulux Software's Mobile App7.5 High
- g5theme essential real estateWordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- barn2 plugins document library liteWordPress Document Library Lite plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- fapi business s.r.o. memberWordPress FAPI Member plugin <= 2.2.30 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- invoiceplaneInvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler...4.3 Medium
- apache fineractApache Fineract: IDOR via self-service API8.1 High
- themefic ultra addons for contact form 7Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF4.3 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreIn GroupSession, a Circular notice can be created with its memo field non-editable, but the...5.3 Medium
- campay woocommerce payment gatewayCampay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment Bypass5.3 Medium
- nextcloud serverNextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core...4.3 Medium
- netiket information technologies ltd. co. applylogicIDOR in Netiket''s ApplyLogic7.6 High
- aksis computer services and consulting inc. axonboardIDOR in Aksis Computer's AxOnboard7.6 High
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- eibiz i-media server digital signageEIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure8.7 High
- im park information technology, electronics, press, publishing and advertising, education ltd. co. dijidemiIDOR in Im Park's DijiDemi4.3 Medium
- cronosweb i2a cronoswebDirect reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A8.3 High
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerability5.3 Medium
- thimpress thim elementor kitWordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- adata mitarbeiter portalMultiple Incorrect Access Control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2...8.1 High
- enalean tuleapTuleap exposes releases for all projects to File Release System project administrators6.5 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id5.3 Medium
- kiteworks security-advisories, nextcloud two-factor webauthn +1 moreNextcloud Twofactor WebAuthn app was updated based on public key3.1 Low
- nextcloud talk, kiteworks security-advisories +1 moreNextcloud talk allows participants to blindly delete poll drafts of other users by ID3.5 Low
- nextcloud tables, kiteworks security-advisories +1 moreNextcloud Tables app allowed users to view columns metadata information of any table4.3 Medium
- nextcloud tables, kiteworks security-advisories +1 moreNextcloud Tables is missing an ownership check which allows moving columns into tables of other users6.3 Medium
- nextcloud tables, kiteworks security-advisories +1 moreNextcloud Tables app share information not limited to relevant users4.3 Medium
- nextcloud calendar, kiteworks security-advisories +1 moreNextcloud Calendar app allowed booking appointments without the generated token3.3 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server users can modify tags on files that do not belong to them4.3 Medium
- soliscloud monitoring platform (cloud api & device control api)The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure...8.3 High
- medtronic carelink networkInsecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an...2.2 Low
- edupluscampusAn Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student...6.5 Medium
- romm.app rommInsecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections7.1 High
- romm.app rommRomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections5.3 Medium
- realmag777 husky – products filter professional for woocommerceHUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'4.3 Medium
- unknown timetable and event schedule by motopressTimetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR2.7 Low
- ams development corp. gamsAuthorization bypass in GAMS from GAMS Development Corp.6.9 Medium
- getgrav gravGrav vulnerable to Information Disclosure via IDOR in Grav Admin Panel4.3 Medium
- phpface streamtube coreStreamTube Core <= 4.78 - Unauthenticated Arbitrary User Password Change9.8 Critical
- uniong webitrUniong｜WebITR - Authorization Bypass7.7 High
- qodeinteractive qode wishlist for woocommerceQODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update5.3 Medium
- Show moreLoading…