CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- langflowLangflow has Missing Ownership Verification in API Key Deletion (IDOR)6.1 Medium
- canonical jujuInsecure Direct Object Reference attack via predictable secret ID in Juju6.6 Medium
- mdjnelson moodle-mod customcertmdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key9.6 Critical
- getsentry sentrySentry allows unauthorized access to event data across organizational boundaries5.7 Medium
- getoutline outlineOutline's IDOR allows unauthorized viewing and seizing of private deleted drafts8.1 High
- typo3 extension "e-mail mfa provider", mrsilaz mfa mail +1 moreAuthentication Bypass in extension "E-Mail MFA Provider" (mfa_email)7.7 High
- studiocmsStudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens2.7 Low
- mattermost, mattermost server +1 moreMissing authorization check allows unauthorized modification of other users' comments on a board4.3 Medium
- wakyma application webIdentity based authorization bypass vulnerability (IDOR) in the Wakyma application web8.6 High
- telesquare sdt-cs3b1, sdt-cs3b1 firmware +1 moreTelesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference9.3 Critical
- No product listedAn Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8....5.3 Medium
- wowza streaming engineWowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm_x64.exe8.5 High
- codegenieapp serverless-expressCodeGenieApp serverless-express API Endpoint TodoList.ts authorization5.3 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id7.5 High
- wickedplugins wicked folders – folder organizer for pages, posts, and custom post typesWicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion4.3 Medium
- openclawOpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands7.1 High
- pointsharp id serverBroken access control vulnerability affecting ID Server8.8 High
- strategy11team formidable forms – contact form plugin, survey, quiz, payment, calculator form & custom form builderFormidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter5.3 Medium
- roxnor getgenie – ai content writer with keyword research & seo tracking toolsGetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion5.4 Medium
- roxnor getgenie – ai content writer with keyword research & seo tracking toolsGetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API6.4 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via authorization bypass in admin api3.1 Low
- zitadelZITADEL Cross-Tenant Information Disclosure in Management API7.7 High
- wintercms winterWinter: Privilege escalation by authenticated backend users10.0 Critical
- studiocmsStudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings5.4 Medium
- studiocmsStudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation6.8 Medium
- comppolicylab pingpongPingPong has improper access control in thread file endpoints allows access outside intended scope8.6 High
- sapido rb-1732SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmd9.3 Critical
- taskosaurTaskosaur Improper Role Assignment via Parameter Manipulation in User Registration9.8 Critical
- smub exactmetrics – google analytics dashboard for wordpress (website stats plugin)ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation8.8 High
- thehappymonster happy addons for elementorHappy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter5.4 Medium
- thehappymonster happy addons for elementorHappy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions6.4 Medium
- unknown gutena formsGutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update6.8 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration8.1 High
- classroomioAn issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the...8.1 High
- umbraco cms, umbraco-cms +1 moreUmbraco Backoffice API Allows Unauthorized Modification of Domain Data5.4 Medium
- syliusSylius affected by IDOR in Cart and Checkout LiveComponents7.1 High
- kovah linkaceLinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy()5.3 Medium
- craftcms commerce, craft commerce +1 moreCraft Commerce has a Potential IDOR in Commerce carts6.3 Medium
- github enterprise serverImproper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access5.3 Medium
- coralos coral server, coral-protocol coral-server +1 moreCoral Server has insufficient agent authentication in session communication channels7.6 High
- studiocmsStudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service7.1 High
- studiocmsStudioCMS Affected by Privilege Escalation via Insecure API Token Generation8.8 High
- hackerbay oneuptimeOneUptime has WhatsApp Resend Verification Authorization Bypass5.3 Medium
- misskeyMisskey lacks resource ownership validation2.3 Low
openclawnpmOpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping5.4 MediumopenclawnpmOpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots6.3 Medium- admidioAdmidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter5.3 Medium
- freshrssFreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens7.5 High
- hackerbay oneuptimeOneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding8.6 High
- Show moreLoading…