CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- franklioxygen mytubeMyTube has an Improper Access Control that Allows Complete Application Takeover7.4 High
- opensourcepos open source point of sale, opensourcepos +1 moreOpen Source Point of Sale has an IDOR in Password Change (Home)6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories3.1 Low
- openwebui open webui, open-webui +1 moreOpen WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite7.1 High
- openclawOpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk2.3 Low
- openclawOpenClaw < 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology Chat6.0 Medium
- tandoor recipesTandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_4045.5 Medium
- wwbn avideoAVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions4.3 Medium
- wwbn avideoAVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents5.3 Medium
- craftcms cmsCraft CMS - Authorization Bypass in assets/preview-file Endpoint5.3 Medium
- go-vikunja vikunjaVikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR9.3 Critical
- elemntor elementor website builder – more than just a page builderElementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template4.3 Medium
- open-emr openemrOpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification8.1 High
- open-emr openemrOpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures4.3 Medium
- open-emr openemrOpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access6.5 Medium
- open-emr openemrOpenEMR has IDOR in Fee Sheet Product Save6.5 Medium
- ibm infosphere information serverIBM InfoSphere Information Server is vulnerable due to Insecure Direct Object Reference5.7 Medium
- n8nn8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no6.3 Medium
- n8nn8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition8.5 High
- devolutions server, hypr +1 moreAuthorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege...5.6 Medium
- joomsky js help deskWordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- latepointWordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- convers lab wpsubscriptionWordPress WPSubscription plugin <= 1.8.10 - Insecure Direct Object References (IDOR) vulnerability8.6 High
- solidtimesolidtime vulnerable to IDOR in private projects6.5 Medium
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad8.8 High
- craftcms cms, craft cms +1 moreCraft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL2.7 Low
- craftcms cms, craft cms +1 moreCraft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)4.9 Medium
- go-vikunja vikunjaVikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion6.9 Medium
- go-vikunja vikunjaVikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion8.1 High
- blinkoBlinko: multiple interfaces in the comment feature allow unauthorized access6.9 Medium
- blinkoBlinko: IDOR - user.detail Endpoint Leaks Superadmin Token6.0 Medium
- opensource-workshop connect-cmsConnect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information8.1 High
- newapi new api, quantumnous new-api +1 moreNew API: IDOR in VideoProxy allows cross-user video content access via missing ownership check6.5 Medium
- No product listedMacCMS Member Order Detail User.php order_info authorization5.3 Medium
- mickasmt next-saas-stripe-startermickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization2.3 Low
- discourseDiscourse has inferable private group membership or existence via exclude_groups parameter6.9 Medium
- langflowLangflow has Unauthenticated IDOR on Image Downloads7.5 High
- go-vikunja vikunjaVikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments5.3 Medium
- discourseDiscourse's unscoped status lookups leak restricted metadata5.3 Medium
- discourseDiscourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check5.3 Medium
- suitecrm, suitecrm suitecrm-core +1 moreSuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)6.5 Medium
- suitecrmSuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints8.1 High
- open-emr openemrOpenEMR has Authorization Bypass in Dated Reminders Log6.5 Medium
- open-emr openemrOpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals6.5 Medium
- wwbn avideoAVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php5.1 Medium
- opexus ecomplaint, opexustech ecase ecomplaint +1 moreOPEXUS eComplaint unauthenticated file upload5.3 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- really simple plugins b.v. simple security proWordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- open-emr openemrOpenEMR's Message Update Ignores Patient id6.5 Medium
- filebrowserFile Browser has an Authorization Policy Bypass in its Public Share Download Flow6.5 Medium
- Show moreLoading…