CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- flowiseai flowiseFlowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- yordam information technology consulting, training and electronic systems industry and trade inc. library automation systemIDOR in Yordam Informatics' Library Automation System8.8 High
- appyap technology and information inc. yaay social media appIDOR in APPYAP's Yaay Social Media App8.8 High
- stel order orderUnsafe Object Reference (IDOR) vulnerability in Stel Order7.1 High
- im park information technology, electronics, press, publishing and advertising, education ltd. co. dijidemiIDOR in Im Park's DijiDemi6.8 Medium
- akilli commerce software technologies ltd. co. e-commerce websiteIDOR in Akıllı Ticaret's E-Commerce Pack9.8 Critical
- websoudan mw wp formMW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter5.3 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter8.2 High
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter8.2 High
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter4.3 Medium
- dataease sqlbotSQLBot: Unauthorized Access Vulnerability8.6 High
- obot-platform obotobot before v0.21.1 Authorization Bypass via /mcp-connect9.3 Critical
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter5.3 Medium
- ghera74 ilghera support system for woocommerceilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure5.3 Medium
- karnop gojobsGoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint5.3 Medium
- no-instructions relay-serverRelay Server WebSocket authentication bypass when token is omitted9.1 Critical
- webpros whmcsInsufficient ownership checks in `clientarea.php` allow an authenticated client area user to...9.1 Critical
- abis technology ltd. co. bapsisIDOR in Abis Technology's BAPSİS8.8 High
- No product listedAn insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send...5.4 Medium
- outlineOutline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7)7.7 High
- mantisbtMantisBT: Authorization Bypass in Global Profile Creation5.3 Medium
- meari iot cloud mqtt broker emqxMeari MQTT broker missing per-device subscribe ACL7.7 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Inconsistent authorization controls within memories API8.3 High
- No product listedHireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object...8.1 High
- No product listedJeecgBoot mLogin Endpoint LoginController.java authorization6.3 Medium
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)4.3 Medium
- syslifters sysreptorSysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional6.8 Medium
- mailenable, mailenable enterprise premium +1 moreMailEnable Enterprise Premium < 10.55 Authorization Bypass via WebAdmin8.7 High
- solidtimesolidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID5.8 Medium
- opnsense coreUltraDAG: Smart Account Spending Policy Bypass via Pockets8.8 High
- onyxOnyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files6.5 Medium
- onyxOnyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions4.3 Medium
- freescout-help-desk freescoutFreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass7.1 High
- yith woocommerce wishlistWordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 moreSpring Cloud Config has an Authorization Bypass Through User-Controlled Key7.5 High
- gittufgittuf: Policy can be rolled back to prior valid version4.9 Medium
- shellhubShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check6.5 Medium
- aegraAegra: Cross-user run injection in /threads/{thread_id}/runs (IDOR)8.6 High
- shellhubShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data6.5 Medium
- shellhubShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace6.5 Medium
- hatchetHatchet: Cross-tenant information disclosure in `listTasksByDAGIds`5.3 Medium
- cisco slido, webex meetings +1 moreA vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote...5.4 Medium
- flowiseai flowiseFlowiseAI Flowise User Controller authorization5.3 Medium
- rapid7 velociraptorGetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations5.0 Medium
- wwbn avideoWWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements4.2 Medium
- Show moreLoading…