CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- crater-invoice craterCrater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion8.2 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference6.5 Medium
- unknown dhl shipping germany for woocommerceDHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR5.3 Medium
- multivendorxMultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint2.7 Low
- ehco1996 django-sspanelEhco1996 django-sspanel Support Ticket views.py TicketDetailView authorization5.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup4.3 Medium
- flowiseai flowiseFlowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation8.3 High
- flowiseai flowiseFlowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API8.8 High
- flowiseai flowiseFlowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration8.5 High
- flowiseai flowiseFlowise before 3.1.3 IDOR via customer-default-source endpoint6.0 Medium
- themefusecom brizyBrizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR2.7 Low
- diaowen dwsurveydiaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization5.3 Medium
- misskey-dev misskeyMisskey: Lack of proper permission checks in Direct Messaging feature2.3 Low
- jeequan jeepayjeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization5.3 Medium
- admidioAdmidio before 5.0.11 IDOR via save_temporary mylist_function.php5.3 Medium
- menulux software inc. mobile appIDOR in Menulux Software's Mobile App9.8 Critical
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API4.3 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint4.3 Medium
- unknown geo my wpGeo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR4.3 Medium
- unknown tag, category, and taxonomy managerTaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR2.7 Low
- go-vikunja vikunjaVikunja 0.24.0 Broken Object Level Authorization via Link-Share Token9.3 Critical
- metagauss profilegridProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR4.3 Medium
- mahmudul hasan arif fluentboardsFluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR4.3 Medium
- woocommerce paypal paymentsWooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure5.3 Medium
- theeventscalendar event tickets and registrationEvent Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR2.2 Low
- themefusecom brizyBrizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info2.7 Low
- shahjahan jewel fluent supportFluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR3.8 Low
- coturnCoturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover7.1 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner9.3 Critical
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter5.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints4.9 Medium
- tomdever wpforo forumwpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR5.4 Medium
- kodezen llc academy lmsAcademy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint4.3 Medium
- unknown buddypressBuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR5.4 Medium
- joomsky js help deskJS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR6.5 Medium
- unknown fluentcart a new era of ecommerceFluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes3.7 Low
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR4.3 Medium
- unknown events made easyEvents Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR5.3 Medium
- persesPerses project query parameter authorization bypass exposes cross-project resources7.1 High
- sylius molliepluginSylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII6.5 Medium
- sylius molliepluginSylius Mollie Plugin: Payment status forgery via the payment webhook7.5 High
- ibm langflow oss, langflow +1 moreBroken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints7.1 High
- foreupforeUP customer REST API allows unauthenticated endpoint access8.1 High
- julep-ai julepJulep Insecure Direct Object Reference via GET /executions/{execution_id}8.6 High
- themeum tutor lmsTutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection5.4 Medium
- unknown essential addons for elementorEssential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table5.3 Medium
- arraytics eventinEventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation7.5 High
- unknown wp travel, wp travel travel +1 moreWP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR4.3 Medium
- metagauss registrationmagicRegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification5.3 Medium
- Show moreLoading…