CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- unknown smartcrawl seo checker, analyzer & optimizerSmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration4.3 Medium
- unknown yaycurrencyYayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration5.3 Medium
- pickplugins user verification by pickpluginsUser Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR7.5 High
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR2.7 Low
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR2.7 Low
- unknown wcfm marketplaceWCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR4.3 Medium
- arraytics eventinEventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR6.5 Medium
- arraytics eventinEventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR8.1 High
- No product listedAn issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain...7.5 High
- netflix lemurLemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it7.3 High
- netflix lemurLemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates8.1 High
- kurrier-org kurrierKurrier: Authenticated cross-user authorization bypass in Kurrier API5.3 Medium
- geolens-io geolensGeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data7.5 High
- goauthentik authentikauthentik RAC: access any endpoint via an unrelated application8.8 High
- @tinacms graphqlPrivilege Escalation via Dropped Field-Level @authentication7.6 High
- givanz vvvebVvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products7.6 High
- givanz vvvebVvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions8.3 High
- givanz vvvebVvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products7.6 High
- givanz vvvebVvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions8.3 High
- givanz vvvebVvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products8.8 High
- givanz vvvebVvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts8.3 High
- givanz vvvebVvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts7.6 High
- givanz vvvebVvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets8.8 High
- mybbMyBB: Insufficient authorization for private calendar events5.4 Medium
- hoppscotchHoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers7.6 High
- razorpay for woocommerceWordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- wpdevart booking calendar, appointment booking systemWordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- pantherius modal surveyWordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- netiket information technologies edowebIDOR in Netiket Information Technologies' EdoWEB5.3 Medium
- onyx-dot-app onyxOnyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure6.5 Medium
- phpipamphpIPAM Temporary Subnet Share Information Disclosure via Address Parameter8.7 High
- crawlab-team crawlabCrawlab Missing Authorization on Password Change Endpoint Allows Account Takeover8.7 High
- apostrophecms apostropheApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree6.5 Medium
- webkul bagistoWebkul Bagisto Backend Sales RMA Endpoint requests authorization5.1 Medium
- webkul bagistoWebkul Bagisto Configuration Management execute authorization5.3 Medium
- unknown shopsmart loyalty for woocommerceShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone5.3 Medium
- belkin ax1800, gl.inet a1300, axt1800 +14 more +16 moreGL.iNet XE3000 WebDAV Service MOVE authorization6.9 Medium
- codecanyon timecamp integration for crmCodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization5.3 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter5.3 Medium
- buildwps ppwp – password protect pagesPassword Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update4.3 Medium
- croixhaug simply schedule appointmentsAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure6.5 Medium
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter4.3 Medium
- themetechmount truebooker – appointment booking and scheduler systemTrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter9.8 Critical
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: repository notification uuid idor in quay api5.3 Medium
- webkul bagistoWebkul Bagisto Backend Reporting Endpoint sales authorization5.3 Medium
- webkul bagistoWebkul Bagisto Backend Customer Detail Feature view authorization5.3 Medium
- webkul bagistoWebkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization5.1 Medium
- roskus prospero flow crmIDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation8.6 High
- francoisjacquet rosariosisfrancoisjacquet RosarioSIS Referrals.php DBUpdate authorization5.3 Medium
- openchoreoOpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints8.8 High
- Show moreLoading…