CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- baptistearno typebot.ioTypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter3.1 Low
- baptistearno typebot.ioTypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint7.1 High
- baptistearno typebot.ioTypebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure6.5 Medium
- devolutions serverAuthorization bypass in the entry duplication feature in Devolutions Server allows an...2.6 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog2.3 Low
- mattermost, mattermost server +1 moreImproper file ownership validation in the Boards API allows unauthorised file access5.9 Medium
- cssigniterteam audioigniter music playerAudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog6.3 Medium
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreLiteLLM < 1.83.14 Privilege Escalation via API Key Generation8.7 High
- akinsoft qr menuIDOR in PosCube's QR Menu7.5 High
- apache software foundation camel kApache Camel K: Camel K Cross-Namespace Build Deputy Attack8.1 High
- broadstreetads broadstreetBroadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta4.3 Medium
- altium 365Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction10.0 Critical
- mispUnauthorized ShadowAttribute modification in MISP via client-supplied identifier8.3 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: cross-session email verification proof not bound to upstream identity in first-broker-login6.4 Medium
- thorsten phpmyfaqphpMyFAQ - Insecure Direct Object Reference in User Password API8.7 High
- phenixdigital phoenix storybookCross-session PubSub topic injection via URL parameter in phoenix_storybook2.3 Low
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API4.3 Medium
- oliverpos oliver pos – a woocommerce point of sale (pos)Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header6.5 Medium
github.com/Kuadrant/mcp-gatewayGoMCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path9.3 Critical- sparx systems pro cloud serverAuthentication Bypass in Sparx Pro Cloud Server9.3 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api4.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference6.8 Medium
- typo3 extension "frontend user registration"Broken Access Control in extension "Frontend User Registration" (sf_register)6.9 Medium
- difyDify < 1.14.2 Authorization Bypass via File Preview Endpoint8.2 High
- difyDify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints9.3 Critical
- tencent weknoraTencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization5.3 Medium
- givanz vvvebVvveb: checkout IDOR allows unauthorized reuse of another user's cart7.6 High
- givanz vvvebVvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens8.1 High
- mathesar-foundation mathesarMathesar: Missing collaborator checks allowed access to saved explorations in other databases5.3 Medium
- avideoAVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint9.2 Critical
- code16 sharpAuthenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint7.7 High
- tuistTuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion8.0 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Indirect Object Reference (IDOR) in user notes6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints8.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls7.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Broken Access Control for Completions API7.1 High
- openclaw crabboxCrabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpoints8.6 High
- n8nn8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints8.3 High
- wger-project wgerwger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API7.5 High
- flowiseai flowiseFlowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- Show moreLoading…