CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- macwarrior clipbucket-v5ClipBucket: IDOR in videos subtitle editor6.5 Medium
- filamentphp filamentFilament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields6.5 Medium
- duck-organization quest-botQuest Bot: AutoMod removal can delete rules from another guild by global rule ID8.3 High
- ibm langflow oss, langflow +1 moreUnauthenticated Session History Access via Public Flow Execution7.5 High
- os4ed opensis-classicopenSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail7.1 High
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab3.7 Low
- cerebrateCerebrate primary key mass assignment in CRUD edit operations allows authenticated users to overwrite unrelated records6.3 Medium
- essential plugin wp logo showcase responsive slider and carouselWordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability5.3 Medium
- makeplane planePlane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces8.3 High
- roxy-wiRoxy-WI: IDOR — any authenticated user can read another user's full action history4.3 Medium
- roxy-wiRoxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body9.1 Critical
- roxy-wiRoxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server9.9 Critical
- kebev2v migration assessmentMigration-planner: getsourcedownloadurl missing organization check9.6 Critical
- kebev2v migration assessmentMigration-planner: agent api ignores jwt source_id claim9.6 Critical
- buddypressBuddyPress 14.4.0 Friends List IDOR via REST API5.3 Medium
- buddypressBuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter8.6 High
- everpure flasharrayA flaw exists in the FlashArray Purity management interface where an authenticated low-privileged...8.6 High
- qnap qumagieQuMagie8.7 High
- 6storage rentals, sixstorage 6storage rentals +1 more6Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter7.5 High
- arnasdon wacrmWACRM Authorization Bypass via Automation Engine Endpoint5.1 Medium
github.com/weaviate/weaviateGo,govulncheck-vulndbopenSUSE +1 moreWeaviate Static API Key client.go validateConfig authorization2.3 Low- nousresearch hermes-agentNousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization5.3 Medium
- masaakitanaka booking packageBooking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action7.2 High
- chrisvrichardson mappress maps for wordpressMapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints5.3 Medium
- klamra22 klamra paycal for aspaclariaKlamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter4.3 Medium
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler5.3 Medium
- smub charitable – donation plugin for wordpress – fundraising with recurring donations & moreCharitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter4.3 Medium
- shopperdotcom shopperShopper: Multiple data integrity and disclosure issues in admin Livewire components8.7 High
- haxtheweb haxcms-phpHAX CMS has Unauthenticated Git Access via User-Controlled Key6.9 Medium
- termixTermix Vulnerable to Arbitrary Command Execution in File Manager9.0 Critical
- termixTermix Vulnerable to Arbitrary Command Execution via Session Hijacking9.0 Critical
- termixTermix has a File-Manager Session Hijack via Missing Ownership Check (IDOR)8.1 High
- mervinpraison praisonai-platformpraisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR8.3 High
- nocodbNocoDB: Missing Ownership Check in MCP Attachment Read2.3 Low
- nocodbNocoDB: Hidden Column Exposure in Public Shared View Endpoints6.9 Medium
- linqi gmbh linqiIDOR in Comment API Allows Cross-Process Comment Read and Write7.1 High
- google chromeInsufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote...6.5 Medium
- runzero platform, shopware +1 moreShopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment4.3 Medium
- better-auth better auth, better-auth +1 moreBetter Auth: Device authorization approve and deny accept any authenticated session while the user code is pending7.6 High
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreSummary Service Insecure Direct Object Reference5.3 Medium
- itpison omicard edmITPison｜OMICARD EDM - Insecure Direct Object Reference6.9 Medium
- abb t-mac plusBroken Access Control in ABB T-MAC Plus web application7.3 High
- progress sitefinityCWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity8.8 High
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key3.7 Low
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key4.3 Medium
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key5.4 Medium
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key6.5 Medium
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key6.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud: Propfind requests for file comments allowed to load comments for other files6.8 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update8.1 High
- Show moreLoading…