CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- google chromePolicy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to...4.3 Medium
- inventreeInvenTree has Arbitrary API Token Creation8.3 High
- aces lorisLORIS has incorrect access checks in document_repository6.3 Medium
- aces lorisLORIS has incorrect access checks in media module6.3 Medium
- redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2.0 +7 more +9 moreMirror-registry: quay: insecure direct object reference in blobupload7.4 High
- cloud solutions sas wimi teamwork, wimi-teamwork +1 moreWimi Teamwork On-Premises < 8.2.0 IDOR via preview.php5.3 Medium
- dfactory download attachmentsWordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- wpstreamWordPress WpStream plugin < 4.11.2 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- wp chill image photo gallery final tiles gridWordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability2.7 Low
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter4.3 Medium
- awesomesupport awesome support – wordpress helpdesk & support pluginAwesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter5.3 Medium
- masteriyo lms – online course builder for elearning, lms & educationMasteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint5.3 Medium
- makeplane planePlane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint6.5 Medium
- erudika scooldScoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask6.5 Medium
- openclawOpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery6.9 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families8.1 High
- freescoutFreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration6.9 Medium
- freescoutFreeScout Customer Merge Cross-Mailbox Authorization Bypass7.6 High
- tandoor recipesTandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/`7.3 High
- ameliabooking booking for appointments and events calendar – ameliaAmelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter8.8 High
- ajax30 bravecms, bravecms-2.0 +1 moreBrave CMS has an Insecure Direct Object Reference in Article Image Deletion7.1 High
- chyrplite chyrp lite, xenocrat chyrp-lite +1 moreChyrp Lite has an IDOR via Mass Assignment in Post Model6.5 Medium
- tandoor recipesTandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification8.1 High
- scoder lupa, red hat openshift ai (rhoai), satellite 6.18 +2 moreLupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr7.9 High
- kaleris yard management solutionsIncorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the...4.3 Medium
- wclovers wcfm – frontend manager for woocommerceWCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation8.1 High
- directusDirectus has a Path Traversal and Broken Access Control in File Management API8.5 High
- gardyn cloud apiGardyn Cloud API Authorization Bypass Through User-Controlled Key9.3 Critical
- mattermost focalboardFocalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)4.3 Medium
- openclawOpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages2.3 Low
- erudika scooldScoold: Cross-Account Feedback Deletion (IDOR)6.5 Medium
- knadh listmonklistmonk: Broken Access Control in CSV Import (Unauthorized List Assignment)5.4 Medium
- sourcecodester leave application systemSourceCodester Leave Application System User Information index.php authorization6.9 Medium
- automattic mongooseCesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization6.3 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key8.7 High
- temporal technologies, inc. temporalCross Namespace Access via Batch Operation2.3 Low
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignmen…4.3 Medium
- 1millionbot millie chat, millie chatbot +1 moreMultiple vulnerabilities in 1millionbot Millie chatbot7.0 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys8.8 High
- on24 q&a chatAuthorization Bypass in ON24 Q&A chat8.7 High
- wp chill download monitorDownload Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'7.5 High
- openclawOpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName2.3 Low
- openclawOpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution7.1 High
- openclawOpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route7.1 High
- langflow, langflow langflow-base +1 moreLangflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check8.7 High
- danny-avila librechatLibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chats5.3 Medium
- lfprojects mcp ruby sdk, modelcontextprotocol ruby-sdk +1 moreMCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay8.2 High
- openbmb xagentOpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization2.3 Low
- black duck coverityCoverity CLI Authentication Bypass9.3 Critical
- Show moreLoading…