CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- syliusSylius: IDOR on Shop Payment Request API endpoints6.3 Medium
- tryghost ghostGhost: Paid gift memberships obtainable at minimal cost via the donations feature5.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding3.1 Low
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id7.7 High
- mettle sendportalmettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization5.3 Medium
- pavo financial technology solutions inc. payIDOR in PAVO Inc.'s PAVO Pay7.5 High
- themefic hydra booking — appointment scheduling & booking calendarHydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter4.3 Medium
- wedevs user frontend: ai powered frontend posting, user directory, profile builder, membership & user registrationUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf…5.3 Medium
- rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpressGamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter5.3 Medium
- divi engine form builderDivi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form8.8 High
- rclonerclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories8.8 High
- No product listedA Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a...8.1 High
- No product listedAn issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via...8.1 High
- No product listedAn Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c...8.1 High
- nl-portal nl-portal-backend-librariesNL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak8.1 High
- citeum openctiOpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection7.1 High
- ronf asyncsshAsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion5.9 Medium
- bitwarden serverBitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request9.3 Critical
- No product listedHarness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization5.3 Medium
- n8nn8n - Improper Authorization in Workflow Assignment to Folders5.3 Medium
- wedevs user frontend: ai powered frontend posting, user directory, profile builder, membership & user registrationUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite5.3 Medium
- wclovers wcfm membership – woocommerce memberships for multivendor marketplaceWCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite8.1 High
- zhenorzz goployGoploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers9.6 Critical
- labring fastgptFastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord7.1 High
- labring fastgptFastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)8.6 High
- better-auth scimbetter-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass8.7 High
- dataeaseDataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets7.1 High
- dataeaseDataEase ExportCenter IDOR allows cross-user export task access8.7 High
- egroupwareRemote Code Execution Vulnerability in EGroupware8.7 High
- apache airflowApache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}6.5 Medium
- idvlabs software and consulting services inc. ontimeIDOR in Idvlabs' Ontime7.5 High
- idvlabs software and consulting services inc. ontimeIDOR in Idvlabs' Ontime7.5 High
- microrealestateBroken object-level access control on the Template API in MicroRealEstate allows attackers to...5.3 Medium
- microrealestateBroken object-level access controls and the use of a deterministic pattern during random ID...7.1 High
- microrealestateMicroRealEstate is affected by broken object-level access controls in PDF generator functionality...7.1 High
- coollabsio coolifyCross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()9.9 Critical
- coollabsio coolifyCoolify: Cross-team IDOR in logs component (resource lookup not team-scoped)7.7 High
- fossbillingFOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders8.6 High
- fossbillingFOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints8.7 High
- coollabsio coolifyCoolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor5.0 Medium
- coderCoder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID8.7 High
- openremoteOpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl7.7 High
- leantimeLeantime - JSON-RPC API Broken Access Control via users.getUser8.6 High
- adiss biloopIncorrect authorisation in Adiss’s Biloop9.3 Critical
- apache camel, apache software foundation camel salesforce +1 moreApache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour5.3 Medium
- apache camel, apache software foundation camel jira +1 moreApache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured…5.3 Medium
- apache camel, apache software foundation camel lucene +1 moreApache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search quer…7.5 High
- apache camelApache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query a…5.3 Medium
- craft cmsCraft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization5.3 Medium
- mjperpinosa stumasymjperpinosa stumasy Note Handler/Assignment notes authorization6.9 Medium
- Show moreLoading…