CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- langflowLangflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow8.4 High
- sentriz gonicSubsonic API: any authenticated user can delete or read any other user's playlist (IDOR)7.1 High
- sentriz gonicPath traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist7.1 High
- agenticmail @agenticmail/apiAgenticMail: Cross-agent task authorization bypass in AgenticMail API7.1 High
- nl-portal nl-portal-backend-librariesNL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)6.5 Medium
- civilian board of contract appeals electronic docketing system (eds), government accountability office electronic protest docketing system (epds) +1 moreU.S. GAO EPDS and CBCA EDS user information disclosure6.9 Medium
- mervinpraison praisonaiPraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/Update5.3 Medium
- woodpecker-ci woodpeckerWoodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation7.1 High
- zitadelZITADEL: Cross-Tenant User Leakage via Recycled Identifiers2.3 Low
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wpUsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter2.7 Low
- pressprimer quiz – ai quiz maker, exam builder & lms assessment pluginPressPrimer Quiz <= 2.3.0 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id', 'item_id', and 'rule_id' Parameters4.3 Medium
- dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsyDokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers4.3 Medium
- baptistearno typebot.ioTypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)7.1 High
- steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointcore +1 moreSteeltoe vulnerable to management-port isolation bypass via spoofed Host header8.2 High
- avo-hq avoAvo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation9.6 Critical
- daytonaio daytonaDaytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join6.5 Medium
- nesquena hermes-webuiHermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint7.1 High
- nesquena hermes-webuiHermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion6.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Forged chat-file link allows cross-user file read and deletion8.3 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-user file disclosure via /api/chat/completions image_url field6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Calendar event re-parenting allows writing events into another user's calendar4.3 Medium
- mojoomla school managementWordPress School Management plugin <= 93.1.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- alberto hornero clean loginWordPress Clean Login plugin <= 1.15 - Insecure Direct Object References (IDOR) vulnerability8.2 High
- dimitri grassi salon booking systemWordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability7.3 High
- gitroomhq postiz-appPostiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription4.8 Medium
- daytonaio daytonaDaytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles7.7 High
- openclawOpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy6.0 Medium
- langflowLangflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints8.8 High
- mohammadtanzilurrahman static blockStatic Block <= 2.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode 'id' Attribute4.3 Medium
- elixir-grpc grpcAuthorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding7.6 High
- e4j s.r.l. vikrentcarWordPress VikRentCar plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- wpdeveloper embedpressWordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerability7.5 High
- mra13 simple shopping cartWordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- iqonic design kivicareWordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability6.3 Medium
- eventprimeWordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability7.1 High
- projectopiaWordPress Projectopia plugin <= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- zongzhige shopxoShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorization6.9 Medium
- jordy meow meow galleryMeow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation4.3 Medium
- filebrowserFile Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix7.2 High
- mispMISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records8.8 High
- mispMISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups8.4 High
- mispMISP improper authorization allows organization administrators to modify site administrator user settings5.1 Medium
- parse-community parse-serverParse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL6.9 Medium
- naxclow ix cam, smart doorbell x3, v720 +1 more +3 moreNaxclow IoT Platform Authorization bypass through User-Controlled key8.7 High
- chroma chromadb, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +2 moreAll V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and...8.8 High
- chroma chromadbA lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows...8.8 High
- chroma chromadb, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +2 moreChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection8.8 High
- elated-themes frappeFrappe: Insecure Direct Object Reference for email accounts6.9 Medium
- Show moreLoading…