CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- m1k1o nekoNeko has Self-service Privilege Escalation for Authenticated Users8.8 High
- openprojectOpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup6.5 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI project.py get_projects_organisation authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI agent.py get_schedule_data authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization5.3 Medium
- No product listedA vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated...6.5 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Budget Endpoint budget.py update_budget authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization5.3 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization5.3 Medium
- collabora kodexplorerkodcloud KodExplorer systemRole.class.php roleGroupAction authorization5.3 Medium
- collabora kodexplorerkodcloud KodExplorer systemMember.class.php initInstall authorization5.1 Medium
- churchcrm crmChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`7.1 High
- flowiseai flowiseFlowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials8.2 High
- flowiseai flowiseFlowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)7.6 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID5.3 Medium
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service8.1 High
@paperclipai/servernpmPaperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise9.9 Critical@paperclipai/servernpmPaperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys9.9 Critical- flowiseai flowiseFlowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association8.1 High
- joedolson my-calendarMy Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog8.8 High
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modific…5.3 Medium
- mahmudul hasan arif fluentboardsWordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability8.1 High
- villatheme compeWordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- royalnavneet login as user – switch user & woocommerce login as customerLogin as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie8.8 High
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference4.3 Medium
- wwbn avideoWWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens6.5 Medium
- docmostDocmost has cross-page attachment overwrite via flawed attachmentId overwrite validation5.4 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses7.1 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes6.5 Medium
- mcphubAuthentication bypass in MCPHub5.3 Medium
- siemens sinec nmsA vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do...8.7 High
fat_free_crmRubyGemsFat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID2.1 Low- webkul krayin crmWebkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php8.1 High
- webkul krayin crmWebkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php8.1 High
- webkul krayin crmWebkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php8.8 High
- espocrmEspoCRM: Email importEml can import and delete another user's attachment by raw fileId5.4 Medium
- pancho pachnoPachno 1.0.6 Authentication Bypass via runSwitchUser()7.1 High
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification4.3 Medium
- fastgptBroken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT5.3 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure6.5 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens7.1 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has an Insecure Direct Object Reference (IDOR)7.1 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data6.5 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check7.1 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result7.1 High
- couchcmsCouchCMS Privilege Escalation via f_k_levels_list Parameter8.6 High
- decolua 9routerdecolua 9router Administrative API Endpoint api authorization6.9 Medium
- inspireui mstore api – create native android & ios apps on the cloudMStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update4.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab5.4 Medium
- Show moreLoading…