CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- kiteworks security-advisoriesNextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner3.5 Low
- kiteworks security-advisoriesNextcloud: Private circle can be added to another circle via API2.6 Low
- mervinpraison praisonai-platformpraisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR8.3 High
- mervinpraison praisonai-platformpraisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR8.1 High
- mervinpraison praisonai-platformpraisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR8.1 High
- apache airflowApache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation7.5 High
- apache airflowApache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter4.3 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization5.3 Medium
- dolibarr erp crmDolibarr ERP CRM messaging.php authorization5.3 Medium
- mervinpraison praisonai-platformpraisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOR7.6 High
- mervinpraison praisonai-platformpraisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace ownership check, cross-workspace issue linking + read + delete IDOR8.1 High
- mervinpraison praisonai-platformPraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID8.8 High
- mervinpraison praisonai-platformPraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation9.4 Critical
- mervinpraison praisonai-platformpraisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership6.5 Medium
- mervinpraison praisonai-platformPraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API8.8 High
- admidioAdmidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders8.1 High
- admidioAdmidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders6.5 Medium
- admidioAdmidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`6.5 Medium
- admidioAdmidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges6.5 Medium
- verbb formieFormie: Unauthenticated front-end submission editing can overwrite existing submissions8.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of...6.5 Medium
- dokployDokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation5.3 Medium
- intermesh groupofficeGroup-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write5.1 Medium
- bankpro e-service technology service centerBankPro E-Service Technology｜Service Center - Insecure Direct Object Reference7.1 High
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration2.0 Low
- kovah linkaceLinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes7.1 High
- openreplayCross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch5.3 Medium
- espocrmEspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup6.5 Medium
- espocrmEspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes4.3 Medium
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter5.3 Medium
- mr2p meta field block – display custom fields in the block editor without codingMeta Field Block <= 1.5.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure6.5 Medium
- realmag777 fox – currency switcher professional for woocommerceFOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter4.3 Medium
- jetmonsters timetable and event schedule by motopressTimetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function4.3 Medium
- openstack keystone, red hat openstack platform 13 (queens), openstack platform 16.2 +2 more +4 moreOpenStack Keystone has an Authorization Bypass6.0 Medium
- microsoft ufoMicrosoft UFO WebSocket role spoofing allows authenticated peer task hijacking8.8 High
- microsoft ufoMicrosoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requesters5.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab8.2 High
- pretixInsecure direct object reference3.8 Low
- wordplus bp better messagesWordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- wp wham checkout files upload for woocommerceWordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- No product listedInsecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate...8.8 High
- code100xcode100x Mobile API Authentication Bypass via Header Spoofing8.8 High
- kareadita kavitaKavita: IDOR in /api/Download/*5.9 Medium
- bugsinkBugsink: Issue bulk actions can affect another project’s issue if its UUID is known3.1 Low
- bugsinkBugsink: Issue event views can show an event from another project if its UUID is known3.1 Low
- e107inc e107e107: Broken Access Control in e107 comment edit allows cross-user comment modification6.5 Medium
- No product listedAn Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace...4.3 Medium
- outsystems lifetimeAuthorization Bypass Through User-Controlled Key in OutSystems Lifetime5.3 Medium
- quantumnous new-apiQuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization6.3 Medium
- microsoft azure privileged identity management (pim), azure privileged identity management +1 moreAzure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability8.8 High
- Show moreLoading…