CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 moreMCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal7.1 High
mantisbt/mantisbtPackagistMantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters5.3 Medium- kanboardKanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop7.2 High
- mantisbtMantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator9.3 Critical
- gitroomhq postiz-appPostiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook7.7 High
- penpotPenpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile9.9 Critical
- directusDirectus: Authorization-dependent response served from unsegmented cache key8.6 High
- n8nn8n - Permission Bypass via Expression Parser Mismatch in External Secrets6.0 Medium
- n8nn8n - External Secrets Disclosure via Workflow Node Expressions6.3 Medium
- roskus prospero flow crmAuthorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection6.9 Medium
- roskus prospero flow crmMissing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts8.7 High
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR5.5 Medium
- czlonkowski n8n-mcpn8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments9.9 Critical
- devolutions serverImproper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11,...3.1 Low
- devolutions serverImproper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions...7.5 High
- alextselegidis easyappointmentsEasy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync3.1 Low
- alextselegidis easyappointmentsEasy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass3.3 Low
- alextselegidis easyappointmentsEasy!Appointments has unauthenticated customer PII disclosure on booking reschedule page6.9 Medium
- kodezen academy lmsAcademy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter4.3 Medium
- sesame time timeInadequate access control in Sesame Time session management8.7 High
- poco-ai poco-clawpoco-ai poco-claw Workspace API workspace.py get_workspace_file authorization6.9 Medium
- kimaiKimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation5.3 Medium
- kimaiKimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects5.3 Medium
- kimaiKimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass5.3 Medium
- churchcrm crmChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records7.1 High
- decidimDecidim: JWT-backed authentication can be replayed across organizations8.5 High
- decidimDecidim: Verification admins can access supplied IDs from other organisations4.9 Medium
- apolloconfig apolloApollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId6.5 Medium
- mattermost, mattermost server +1 moreUnscoped updates to other playbooks' metric configuration4.3 Medium
- cozmoslabs user profile pictureWordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability2.7 Low
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- mattermost, mattermost server +1 moreIncoming webhook user attribution via unvalidated webhook owner4.9 Medium
- mattermost, mattermost server +1 moreAuthenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels4.3 Medium
- dassault systèmes tuleap enterprise editionAuthorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.57.5 High
- No product listedMacCMS Pro Installation Index.php step5 authorization6.3 Medium
- wclovers wcfm – frontend manager for woocommerceWCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers4.3 Medium
- wpovernight pdf invoices & packing slips for woocommercePDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute4.3 Medium
- openreplayOpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint7.1 High
- openreplayOpenReplay: Cross-user IDOR in notes and dashboard widgets7.1 High
- grokability snipe-itSnipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint5.0 Medium
- teracity software technologies inc. teramisIDOR in Teracity's TeraMIS8.8 High
- grokability snipe-itSnipe-IT: Missing object-level authorization in Kits API5.3 Medium
- grokability snipe-itSnipe-IT: Cross-company asset maintenance re-parenting via API update7.7 High
- krayin laravel-crmKrayin CRM Insecure Direct Object Reference via Controllers8.7 High
- adam retail automation ltd. mobilmen 20tIDOR in AdamPOS' MobilMen 20T8.8 High
- getgrav gravGrav Admin Plugin — IDOR Privilege Escalation via saveUser()8.7 High
- papermerge dmsInsecure Direct Object Reference in R-SOFT DMS7.1 High
- priyanshuchaudhary flowforms – conversational form builderFlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints4.3 Medium
- fahad mahmood easy upload files during checkoutEasy Upload Files During Checkout <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufdc-delete' Parameter5.3 Medium
- arikusi deepseek-mcp-server@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key8.6 High
- Show moreLoading…