CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsyDokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter4.3 Medium
- nezhahq nezhaNezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check9.9 Critical
solidinvoice/solidinvoicePackagistSolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings8.9 High- juev nebula-meshNebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)8.8 High
- opf openprojectOpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure4.3 Medium
- opf openprojectOpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources4.3 Medium
- opf openprojectOpenProject: Private work package data disclosure through single meeting agenda item API4.3 Medium
- opf openprojectOpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects6.5 Medium
- opf openprojectOpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projects5.4 Medium
- opf openprojectOpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources9.9 Critical
- significant-gravitas autogptAutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering5.4 Medium
- canonical lxdBroken Access Control in Canonical LXD DevLXD API8.4 High
- gravitykit gravityviewWordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- joomsky js help deskWordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- majestic support supportWordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- wp folio team ppwpWordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- creative themes blocksy companion proWordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- site building with toolset toolset formsWordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- tyche softwares payment gateway based fees and discounts for woocommerceWordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- kingaddons trinity backup – backup, migrate, restore, clone & schedule backupsWordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulnerability7.5 High
- psm plugins supportcandyWordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability7.6 High
- about envato bookproWordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- netflix lemurLemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR9.9 Critical
- kanboardKanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID5.3 Medium
- samuelclay newsblurNewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint5.3 Medium
- openidentityplatform openamOpenAM Arbitrary OAuth Token Minting via Push Registration7.6 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: unauthorized access to resources via uma permission ticket bypass4.6 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: group-admin escalation to realm-admin7.7 High
- tooljetToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets6.8 Medium
- pretix venuelessPermissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.2.3 Low
- mycred license manager for woocommerceWordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab5.4 Medium
- fossbillingFOSSBilling: IDOR in Servicecustom Client API allows cross-client data access7.1 High
- twentyhq twentyTwenty: Cross-workspace IDOR in AgentTurnResolver7.6 High
- mintplex-labs anything-llmAnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)0.0 None
- grokability snipe-itSnipe-IT: Multi-Tenancy Bypass via Bulk Asset Update6.3 Medium
- fossbillingFOSSBilling: IDOR Vulnerability in Support Ticket Creation5.1 Medium
- gogsGogs: LFS dedupe path leaks private repo content across tenants7.1 High
- pegasystems pega infinityPega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.7.1 High
- cap-go capgoCapgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings8.6 High
- gogsGogs: Missing Authorization in Attachment Download7.5 High
- paymenterPaymenter: Broken object level authorization via service reference manipulation on ticket creation5.4 Medium
- mattermost, mattermost server +1 moreIDOR in Jira plugin subscription edit endpoint6.4 Medium
- mispBroken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models7.1 High
- mispMISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields9.4 Critical
- cap-go capgoCapgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs7.1 High
- cap-go capgoCapgo - Account Merge via Poisoned public.users.email in SSO Provisioning8.7 High
- openremoteOpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint8.6 High
- eidetic-labs stigmem-nodestigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine8.6 High
- eidetic-labs stigmem-nodestigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones7.2 High
- Show moreLoading…