CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- hoppscotchhoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token0.0 None
- wwbn avideoWWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure5.5 Medium
- tencent weknoraWeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning5.3 Medium
- flowiseai flowiseFlowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration8.8 High
- flintsh flareFlare: Private File IDOR via raw/direct endpoints6.0 Medium
- flintsh flareFlare: Password‑Protected Thumbnail Bypass8.2 High
- wekanWekan has Cross-Board IDOR in Custom Fields Update Endpoints9.3 Critical
- chartbrewChartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations6.5 Medium
- dani-garcia vaultwardenVaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher5.4 Medium
openclawnpmOpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization5.3 Medium- craftcms cms, craft cms +1 moreCraft has an unauthenticated activation email trigger with potential user enumeration6.9 Medium
- cloudflare pingora, https://github.com/cloudflare/pingora +1 moreCache poisoning via insecure-by-default cache key8.4 High
openclawnpmOpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From7.1 High- openclawOpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender6.0 Medium
- openclawOpenClaw < 2026.2.22 - Authorization Bypass via Display Name Collision in Feishu allowFrom6.3 Medium
openclawnpmOpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption5.3 Medium- craftcms cms, craft cms +1 moreCraft has a Permission Bypass and IDOR in Duplicate Entry Action5.3 Medium
- craftcms cms, craft cms +1 moreCraft Affected by Entries Authorship Spoofing via Mass Assignment7.1 High
- craftcms cms, craft cms +1 moreCraft affected by IDOR via GraphQL @parseRefs8.7 High
- nocodbNocoDB: Missing Ownership Validation in MCP Token Operations4.9 Medium
- cgm clininetInsecure Direct Object Reference Message ID7.1 High
- google androidIn parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a...8.4 High
- openclawOpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata5.3 Medium
- seerrSeerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials6.5 Medium
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket v5 has IDOR in Collection Item Management5.7 Medium
- open-emr openemrOpenEMR's Portal Payment Endpoint Trusts User-Controlled pid7.1 High
- brechtvds wp recipe makerWP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter5.3 Medium
- manyfoldManyfold has IDOR in ModelFilesController5.3 Medium
- hoppscotchIDOR in GraphQL userCollection Query Exposes Other Users' Private Collections6.5 Medium
- hoppscotchhoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment8.3 High
- wgerwger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup4.3 Medium
- wgerwger: IDOR via user-unscoped cache keys on routine API actions exposes workout data3.1 Low
- wgerwger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data4.3 Medium
- umbraco umbraco.engage.formsUmbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints7.5 High
- discourseDiscourse doesn't scope reviewable notes to user-visible reviewables4.3 Medium
- discourseDiscourse has IDOR vulnerability in the directory items endpoint7.5 High
- discourseDiscourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint7.5 High
- open-emr openemrOpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership6.5 Medium
- open-emr openemrOpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms6.5 Medium
- open-emr openemrOpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval6.5 Medium
- open-emr openemrOpenEMR Missing Authorization Checks in DICOM Viewer State API7.1 High
- open-emr openemrOpenEMR Messages "Show All" Not Restricted to Admins5.7 Medium
- makeplane planePlane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch4.9 Medium
- feiyuchuixue sz-boot-parentfeiyuchuixue sz-boot-parent API Endpoint sys-message authorization6.9 Medium
- brechtvds wp recipe makerWP Recipe Maker <= 10.2.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure4.3 Medium
- solarwinds serv-uSolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability9.1 Critical
- tenable security centerImproper Access Control5.7 Medium
- tenable security centerIndirect Object Reference (IDOR) in Security Center2.1 Low
- wisdomgarden tronclassWisdomGarden｜Tronclass - Insecure Direct Object Reference6.5 Medium
- cradle e-commercedetronetdip E-commerce Product Management Update authorization5.3 Medium
- Show moreLoading…