CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- streamastreama Insecure Direct Object Reference via ViewingStatusController5.3 Medium
- triggerdotdev trigger.devTrigger.dev: Cross-tenant payload poisoning via packet write + replay4.2 Medium
- triggerdotdev trigger.devTrigger.dev: Cross-project deployment worker registration can modify another project's deployment state9.9 Critical
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models7.1 High
- elastic fleet serverAuthorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure6.5 Medium
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure4.3 Medium
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts6.8 Medium
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification6.5 Medium
- goodrain rainbondRainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access8.6 High
- roskus prospero flow crmIDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking8.6 High
- lasso analytics, inc. do lassoWordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- openremoteOpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference7.1 High
- filebrowserFile Browser before v2.63.22 Authorization Bypass via Recursive Operations8.6 High
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Local Storage6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getRefIDs6.9 Medium
- mat bao corporation wp helper premiumWP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation8.2 High
- unknown booking for appointments and events calendarAmelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR3.7 Low
- cert/cc vinceCVE-2026-187446.5 Medium
- cert/cc vinceCVE-2026-187499.8 Critical
- cert/cc vinceCVE-2026-187505.3 Medium
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreProvider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization5.8 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via resolveAssetPath6.9 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab8.5 High
- microsoft container-migration-solution-acceleratorMicrosoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes8.7 High
- apache alluraApache Allura: Missing permission checks IDOR6.5 Medium
- apache airflowApache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection5.4 Medium
- wintercms winterWinter: Authenticated backend users can bypass Users controller permission checks7.1 High
- opajaap wp photo album plusWP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization4.3 Medium
- unknown wp travel engine, wp travel engine travel engine +1 moreWP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart5.3 Medium
- unknown wp crowdfundingWP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR4.3 Medium
- unknown wp crowdfundingWP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR4.3 Medium
- iqonic design kivicareKiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR4.3 Medium
- arraytics eventinEventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR4.3 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy6.4 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration7.7 High
- baptistearno typebot.ioTypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding9.9 Critical
- grokability snipe-itSnipe-IT Checkout Request Cancellation IDOR5.3 Medium
- taubyte tauTaubyte Tau v1.1.10 Missing Authorization via GET and DELETE /projects/{id}7.2 High
- netbox labs netboxNetBox 4.5.8 ORM Injection via WritableNestedSerializer7.1 High
- baptistearno typebot.ioTypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids7.1 High
- microsoft visual studio codeVisual Studio Code Security Feature Bypass Vulnerability7.8 High
- baptistearno typebot.ioTypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bot's waiting session7.1 High
- owen2345 camaleoncmsCamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController8.7 High
- tooljetToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables5.9 Medium
- attendizeAttendize Attendize - Insecure Direct Object Reference7.1 High
- attendizeAttendize Attendize - Insecure Direct Object Reference7.1 High
- opensignlabs opensignOpenSignLabs OpenSign - Insecure Direct Object Reference7.5 High
- opensignlabs opensignOpenSignLabs OpenSign - Insecure Direct Object Reference7.5 High
- inventec appliances chiline cloudInventec Appliances｜Chiline Cloud - Insecure Direct Object Reference8.7 High
- sap se s/4 hana (reprocess bank statement items)Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items)4.3 Medium
- Show moreLoading…