CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- gitea open source git serverGitea LFS Deploy-Key Privilege Escalation5.4 Medium
- gitea open source git serverCross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API2.7 Low
- gitea open source git serverCross-repository issue/comment attachment re-linking can expose private attachment content5.9 Medium
- gitea open source git serverMissing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in c…5.9 Medium
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise7.1 High
- makeplane planeCVE-2026-153426.5 Medium
- solarwinds serv-uSolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability9.1 Critical
- zsadmin2025 zs-adminzsadmin2025 ZS-Admin MyBatis-Plus Tenant Plugin page getTenantId authorization5.3 Medium
- kodezen llc academy lmsAcademy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR5.4 Medium
- radiustheme classified listingClassified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR4.3 Medium
- pdovhomilja nextcrm-appNextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering7.6 High
- pdovhomilja nextcrm-appNextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering7.1 High
- vsee clinic, clinic api +1 moreVSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion8.7 High
- freescout-help-desk freescoutFreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint6.5 Medium
- surrealdbSurrealDB before 3.2.0 Authentication Bypass via Custom API8.6 High
- guohongze adminsetguohongze adminset Delivery Deployment Endpoint deli.py authorization5.3 Medium
- geex-arts django-jetgeex-arts django-jet Dashboard views.py authorization5.3 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization5.3 Medium
- ibm langflow oss, langflow +1 moreLangflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints8.1 High
- vimesoft inc. enterprise video platformIDOR in Vimesoft's Enterprise Video Platform9.4 Critical
- codephiliax chat2dbChat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasource7.1 High
- gis informatics engineering consulting laboratory r&d and software services inc. gislab laboratory management systemIDOR in GIS Informatics' GisLab Laboratory Management System6.5 Medium
- strangebee thehiveTheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints7.1 High
- matrix-org dendriteDendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint7.1 High
- devolutions serverImproper access control in Hashtopolis server chunk activity component7.1 High
- unknown wps bookings for woocommerceWPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR5.4 Medium
- unknown user registration & membershipUser Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler5.3 Medium
- saturdaydrive ninja forms - excel exportNinja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter4.3 Medium
- getgrav grav-plugin-apiGrav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super8.8 High
- getgrav gravgrav-plugin-api < 1.0.6 Privilege Escalation via createApiKey8.7 High
- salto proaccess spaceSALTO ProAccess Space Authorization Bypass Through User-Controlled Key7.1 High
- arcadedata arcadedbArcadeDB before 26.7.2 Authorization Bypass via Database Handlers9.3 Critical
- activepiecesActivepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL5.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +5 more +7 moreKeycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v24.3 Medium
- microsoft ufoMicrosoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info4.3 Medium
- microsoft simplechatSimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints4.3 Medium
- roskus prospero flow crmIDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders6.9 Medium
- stoatchatstoatchat 20241213-1 Webhook Token Disclosure via Read Permissions7.6 High
- hcl software dfxserver, hcltech dfx server +1 moreHCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.8.2 High
- rometheme rtmkitRTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure2.7 Low
- jordy meow ai engineAI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR5.9 Medium
- rafymrx toko-online-rotiRafyMrX TOKO-ONLINE-ROTI add.php authorization5.3 Medium
- wekanWekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)8.5 High
- wekanWekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID6.5 Medium
- Show moreLoading…