CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- themeplugs authorsyWordPress Authorsy plugin <= 1.0.6 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- mikado-themes pawfriends - pet shop and veterinary wordpress themeWordPress PawFriends - Pet Shop and Veterinary WordPress theme theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- cnvrseWordPress Cnvrse plugin < 026.02.10.20 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- shiprocketWordPress Shiprocket plugin <= 2.0.8 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- lkw199711 smangaAn Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to...9.4 Critical
- mecode informatics and engineering services ltd. envantyIDOR in MeCODE Informatics' Envanty7.3 High
- sonaar mp3 audio player – music player, podcast player & radio by sonaarMP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure5.3 Medium
- expresstech systems quiz and survey masterWordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- n-media frontend file managerWordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- mtekk breadcrumb navxtBreadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure5.3 Medium
- wpdevelop booking calendarBooking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification4.3 Medium
- graylog, graylog web interface +1 moreImproper Access Control (IDOR) vulnerability in Graylog Web Interface7.1 High
- absikandar frontend user notesFrontend User Notes <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification4.3 Medium
- openclawOpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity8.2 High
- phpgurukul hospital management systemThe 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure...6.5 Medium
- convoypanel panelPterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization9.2 Critical
- gogsGogs Allows Cross-Repository Comment Deletion via DeleteComment5.1 Medium
openclawnpmOpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing7.1 High- morelmathieuj scheduler widgetScheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification5.4 Medium
- uni-yaz flexcity, universal software inc. flexcity/kiosk +1 moreIDOR in Universal Sotware's FlexCity/Kiosk8.3 High
- farktor e-commerce packageIDOR in Farktor Software's E-Commerce Package6.3 Medium
- No product listedAn issue in the "My Details" user profile functionality of Ideagen Q-Pulse 7.1.0.32 allows an...4.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab3.5 Low
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- kamleshyadav videospirecore theme pluginVideospirecore Theme Plugin <= 1.0.6 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover8.8 High
- saastech cleaning and internet services inc. temizlikyoldaIDOR in saastech.io's TemizlikYolda5.4 Medium
- kanboardKanboard is missing authorization check in getSwimlane API allows cross-project data access4.3 Medium
- dinibh puzzle software solutions patrol tracking systemIDOR in Dinibh Puzzle's Dinibh Patrol Tracking System8.8 High
- axis camera station proAn insecure direct object reference allowed a non-admin user to modify or remove certain data...5.7 Medium
- wclovers wcfm membership – woocommerce memberships for multivendor marketplaceWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment4.3 Medium
- craftcms cms, craft cms +1 moreCraft has a GraphQL Asset Mutation Privilege Escalation8.6 High
- markusproject markusMarkUs has a submission-view IDOR exposes all student submissions6.5 Medium
- wekanWeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId5.3 Medium
- wekanWeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation7.1 High
- wekanWeKan < 8.19 Checklist Creation Cross-Board IDOR7.1 High
- openprojectOpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer4.3 Medium
- publiccmsSanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization2.3 Low
- bplugins timeline block – beautiful timeline builder for wordpress (vertical & horizontal timelines)Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute4.3 Medium
- spreeSpree allows unauthenticated users can access all guest addresses7.7 High
- spreeUnauthenticated Spree Commerce users can view completed guest orders by Order ID7.7 High
- payloadcms payloadPayload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)5.4 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 moreRestore restriction bypass via key disclosure vulnerability (pgAdmin 4)7.4 High
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification5.3 Medium
- espocrmEspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords8.6 High
- gunet open eclass platform, openeclass +1 moreOpen eClass Unauthenticated IDOR Allows Access to Arbitrary User Files7.5 High
- ht plugins extensions for cf7WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
agentsnpmInsecure Direct Object Reference (IDOR) via Header-Based Email Routing6.9 Medium- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion8.1 High
- alimir wp ulike – like & dislike buttons for engagement and feedbackWP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter5.3 Medium
- Show moreLoading…