CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- gitea open source git serverGitea LFS object reuse bypasses Code-unit authorization7.1 High
- gitea open source git serverGitea email settings allow changing another user's primary email address7.5 High
- gitea open source git serverGitea tracked-time deletion can target entries from another issue5.3 Medium
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view_student authorization5.3 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.14 +5 more +7 moreKeycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource5.4 Medium
- roskus prospero flow crmAuthorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion6.9 Medium
- spacetime ad inserter – ad manager & adsense adsAd Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute4.3 Medium
- jetmonsters motopress appointment bookingMotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter5.3 Medium
- kimaiKimai before 2.57.0 Improper Authorization via Favorite Endpoints8.7 High
- lobehubLobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations2.3 Low
- lobehubLobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search7.1 High
- lobehubLobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes6.0 Medium
@grackle-ai/authnpm,@grackle-ai/mcpnpm,@grackle-ai/plugin-corenpm +2 moreGrackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)8.7 High- themeum kirkiWordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- joedolson my calendar – accessible event managerMy Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter5.3 Medium
- wappointment appointment bookings for zoom googlemeet and more – wappointmentAppointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter5.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter5.3 Medium
- kodezen academy lms – wordpress lms plugin for complete elearning solutionAcademy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure5.3 Medium
- craftcms cmsCraft CMS: Unauthorized Deletion of Source Assets During File Replacement5.3 Medium
- surrealdbSurrealDB before 3.1.0 Authorization Bypass via Composite Record-id5.3 Medium
- api-platform core, api-platform/hal, api-platform/json-api +2 moreAPI Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate5.9 Medium
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: foreman: information disclosure via improper validation of nested request parameters4.3 Medium
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: foreman: unauthorized modification of host configurations via broken access control6.5 Medium
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +5 more +7 moreForeman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass6.5 Medium
- mycomplianceoffice mco, mycomplianceoffice +1 moreInsecure Direct Object Reference in MCO5.3 Medium
- qode qi blocksQi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter4.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter6.5 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter4.3 Medium
- cap-go capgoCapgo - Broken Object Level Authorization via x-limited-key-id Header8.7 High
- iv-org invidiousInvidious - Cross-User Playlist Video Deletion via Missing Ownership Check7.1 High
- ibm langflow oss, langflow +1 moreCross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem9.6 Critical
- paymenterPaymenter: URL parameter injection bypasses paid plan limits at checkout8.5 High
- coollabsio coolifyCoolify: Cross-team application domain enumeration via domains_by_server endpoint4.3 Medium
- coollabsio coolifyCoolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure5.0 Medium
- coollabsio coolifyCoolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)5.0 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +3 more +5 moreKeycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions4.3 Medium
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite9.8 Critical
- coollabsio coolifyCoolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure7.7 High
- coollabsio coolifyCoolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers9.6 Critical
- signozSigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules6.1 Medium
- photoprismPhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint5.3 Medium
- librephotosLibrePhotos < 1.0.0 - Insecure Direct Object Reference in SetPhotosShared Endpoint6.0 Medium
- teableio teableTeable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override6.9 Medium
- modoboaModoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API7.7 High
- colissimo officiel : méthodes de livraison pour woocommerceWordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- matteo manna simple user avatarWordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- codeastro complaint management systemCodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization5.3 Medium
- cherryhq cherry-studioCherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization2.3 Low
- No product listedDatabend Tenant client_session_manager.rs state_key authorization5.3 Medium
- glpi-project glpiglpi-project glpi Document document.send.php canViewFile authorization6.3 Medium
- Show moreLoading…