CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- metagauss registrationmagicRegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR5.3 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR4.3 Medium
- stylemix masterstudy lms wordpress plugin – for online courses and educationMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion6.5 Medium
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsBusiness logic vulnerability4.3 Medium
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsInsecure direct object reference vulnerability3.1 Low
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR5.4 Medium
- No product listedAn Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor...7.5 High
- superplanehq superplaneSuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC8.7 High
- pretixMissing authorization check in event quick setup view2.3 Low
- devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement pluginShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter4.3 Medium
- roskus prospero flow crmIDOR in Prospero Flow CRM allows deletion of other users' notifications6.9 Medium
- papra-hq papraPapra: Cross-organization tag deletion and modification via authenticated cross-tenant request5.4 Medium
- devolutions serverImproper access control in the PAM password history endpoints in Devolutions Server allows an...4.3 Medium
- unitedbyai droidclawunitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization2.3 Low
- john darrel hide my wp ghostWordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability7.4 High
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- red hat container native virtualization 4.14, container native virtualization 4.16, container native virtualization 4.17 +6 more +8 moreVirt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone7.7 High
- leantimeLeantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC7.1 High
- openremoteOpenRemote before 1.26.2 Authentication Bypass via Console Registration9.3 Critical
- openlistteam openlistOpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API6.5 Medium
- openlistteam openlistOpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search4.3 Medium
poweradmin/poweradminPackagistPoweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own8.1 High- openidentityplatform opendjOpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant9.6 Critical
- budibaseBudibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)8.2 High
- nuxsmin syspasssysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption7.1 High
- nuxsmin syspasssysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API8.7 High
- nuxsmin syspasssysPass 3.2.11 Insecure Direct Object Reference via AccountFileController8.6 High
- better-auth stripe@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription7.1 High
- better-auth scimbetter-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision9.4 Critical
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter6.5 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter5.3 Medium
- casdoorCVE-2026-156309.9 Critical
- itflow-org itflowITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal6.5 Medium
- reworkd agentgptAgentGPT 1.0.0 Authorization Bypass via Agent Task Creation2.3 Low
- sct overseerrOverseerr 1.35.0 Authorization Bypass via pushSubscriptions API5.3 Medium
- cyberpanelCyberPanel IncBackups IDOR via Sequential Backup ID8.7 High
- vendidero shiptastic for woocommerceWordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- masteriyo - lmsWordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- pickplugins product slider for woocommerceWordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- easy appointments appointments, easyappointments easy appointments +1 moreWordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- n8nn8n before 1.123.67 Credential Exfiltration via Sub-Workflow7.2 High
- n8nn8n before 1.123.67 Authentication Bypass via HTTP Request Node7.1 High
- cal.com cal.diyCVE-2026-166249.6 Critical
- ibm sterling b2b integrator, sterling file gateway +1 moreIBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization Bypass5.3 Medium
- onlook repoOnlook tRPC Insecure Direct Object Reference via multiple procedures8.7 High
- n8nn8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role7.7 High
- universe software computer marketing trade and industry inc. online registration and workflow management systemIDOR in Universe Software's Online Registration and Workflow Management System6.5 Medium
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure4.3 Medium
- oracle irecruitmentVulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Install /...5.4 Medium
- xuxueli xxl-jobxxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat7.1 High
- Show moreLoading…