CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- getgrav gravGrav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic8.1 High
- langgenius difyDify < 1.14.0 Authorization Bypass via File UUID6.0 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter5.3 Medium
- edge22 generateblocksGenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements6.5 Medium
- codecanyon perfex crmCodeCanyon Perfex CRM Tenant Clients.php project authorization5.3 Medium
- scott paterson easy-paypal-events-ticketsEasy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint8.2 High
- webpros comet backupA critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20...9.9 Critical
- toeverything affinetoeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization6.9 Medium
- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary Download Access via IDOR6.5 Medium
- jsbroks coco annotatorjsbroks COCO Annotator Dataset API datasets.py authorization6.9 Medium
- wclovers wcfm – frontend manager for woocommerceWCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion8.1 High
- zyosoft school appZyosoft｜School App - Insecure Direct Object Reference8.6 High
- appcheap app builder – create native android & ios apps on the flightApp Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter5.3 Medium
- owap defectdojoOWAP DefectDojo Benchmark/Engagement/Product/Survey authorization5.3 Medium
- ibm langflow oss, langflow +1 moreMonitor API allows cross-user read of transaction logs and deletion of build data via flow_id6.5 Medium
- linkstackorg linkstackLinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization5.3 Medium
- ibm langflow desktop, langflow desktop +1 moreUnauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint7.5 High
- chartbrewChartbrew: Incorrect Access Control in project share policy routes via unbound policy_id8.1 High
- meware software development inc. pdksIDOR in MeWare Software's PDKS8.1 High
- n8nn8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure6.0 Medium
- cdac-noida e-sushrut, hospital management information system (hmis)Cryptographic Failure Vulnerability in e-Sushrut HMIS7.1 High
- cdac-noida e-sushrut, hospital management information system (hmis)Broken Access Control Vulnerability in e-Sushrut HMIS7.1 High
- cdac-noida e-sushrut, hospital management information system (hmis)Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS7.1 High
- getoutline outlineOutline has IDOR in document share creation that allows unauthorized access to private documents across workspaces7.7 High
- nvidia nvflare, flare sdk +1 moreNVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system9.8 Critical
- milesight ms-c2964-rflpc, ms-c2966-rflwpc, ms-c2966-x12rlpc +79 more +81 moreMilesight Cameras Authorization Bypass Through User-Controlled Key7.3 High
- mettle sendportalmettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization5.3 Medium
- 1000 projects portfolio management system mca1000 Projects Portfolio Management System MCA update_passwd_process.php authorization5.3 Medium
- ribblr crotchet and knittingAuthenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application5.3 Medium
- openclawOpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template Mapping6.3 Medium
- avo-hq avoAvo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources8.8 High
- codepeople booking calendar contact formBooking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover5.3 Medium
- ckp267 maxiblocks builder | 17,000+ design assets, patterns, icons & starter sitesMaxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter5.3 Medium
- xibosignage xibo, xibo-cms +1 moreXibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization4.3 Medium
- spicejet online booking systemAuthorization bypass through User-Controlled key in SpiceJet Online Booking System8.7 High
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +1 more +3 moreWebkitgtk: authorization bypass through webpage::send-request signal handler4.7 Medium
- thinkphpThinkPHP 5.0.23 Remote Code Execution via invokefunction9.3 Critical
- fullstepInsecure direct object reference (IDOR) vulnerability in Fullstep7.6 High
- augmenttCVE-2026-63556.5 Medium
- bigbluebuttonBigBlueButton's missing authorization allows viewer to inject/overwrite captions6.5 Medium
- github enterprise serverImproper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server7.2 High
- github enterprise serverAuthorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers5.3 Medium
- horilla-opensource horillaHorilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation7.1 High
- horilla-opensource horillaHorilla: Unauthorized Document Overwrite via File Upload Endpoint8.6 High
- horilla-opensource horillaHorilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>7.1 High
- freescout-help-desk freescoutFreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification7.1 High
- freescout-help-desk freescoutFreeScout's Customer AJAX Create Modifies Hidden Existing Customer4.3 Medium
- freescout-help-desk freescoutFreeScout has Customer Edit Cross-Mailbox Email Takeover7.6 High
- freescout-help-desk freescoutFreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII5.7 Medium
- arcadia technology, llc crafty controllerAuthorization Bypass Through User-Controlled Key in Crafty Controller9.0 Critical
- Show moreLoading…