CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- dolibarrDolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route7.1 High
- humansignal label-studioLabel Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset8.7 High
- miniorange.com login with keycloak oauth single sign-on (sso) (free) extension for joomla, miniorange oauth client (free) extension for joomla, oauth single sign-on – oidc sso | login with azure ad (free) extension for joomla +1 more +3 moreJoomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Sing…10.0 Critical
- roskus prospero flow crmIDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification9.3 Critical
- wp manageninja llc fluent boards proWordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- bruno cavalcante ghostwriterGhostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap7.1 High
- aureus erpDolibarr ERP User Notes note.php authorization5.3 Medium
- code-projects barangay resident profiling management systemcode-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization5.3 Medium
- code-projects barangay resident profiling management systemcode-projects Barangay Resident Profiling Management System Restore/Delete archived_records.php authorization5.3 Medium
- braveBrave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview4.3 Medium
- themeum tutor lmsTutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR2.7 Low
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.55.3 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.58.7 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.56.3 Medium
- roskus prospero flow crmUnvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers5.3 Medium
- roskus prospero flow crmIDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records8.7 High
- headroom labs headroomHeadroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity9.3 Critical
- openpanel-dev openpanelOpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries7.1 High
- openpanel-dev openpanelOpenPanel report.get Returns Any Report by Identifier Without Checking Project Access7.1 High
- copydeleteposts duplicate postCopy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure2.7 Low
- mauriceboe trekTREK: Cross-trip reservation title disclosure via file links4.3 Medium
- microsoft partner centerMicrosoft Partner Center Information Disclosure Vulnerability8.6 High
- bigbluebuttonBigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass4.9 Medium
- wintercms winterWinter CMS: My Account preview exposes another backend user's profile by record ID4.3 Medium
- wintercms winterWinter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata5.4 Medium
- laravel-backpack crudbackpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)7.6 High
- laravel-backpack crudbackpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk8.1 High
- django cms association django-cmsdjango CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)6.5 Medium
- django cms association django-cmsdjango CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff4.3 Medium
- django cms association django-cmsdjango CMS: Clipboard copy IDOR discloses unauthorized plugin content6.5 Medium
- atutorInsecure Direct Object Reference in ATutor5.3 Medium
- atutorAuthentication Bypass in ATutor6.3 Medium
- labredescefetrj wegiaWeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php7.1 High
- n8nn8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node5.1 Medium
- n8nn8n before 2.34.1 Authorization Bypass via Custom Role Deletion7.4 High
- n8nn8n before 2.34.1 Cross-Project Credential Access via MCP5.3 Medium
- splunk ai toolkitImproper Access Control in Experiment History through the REST API in Splunk AI Toolkit8.1 High
- splunk, splunk enterprise +1 moreImproper Access Control through the REST API in Splunk Enterprise5.4 Medium
- tinacms next-tinacms-azure, next-tinacms-cloudinary, next-tinacms-dos +2 more +4 moreTina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)5.4 Medium
- termix-ssh termixTermix: Missing authorization in SSH host credential resolution exposes stored credentials9.6 Critical
- termix-ssh termixTermix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users9.6 Critical
- leantime json-rpc apiLeantime JSON-RPC API contains a missing authorization vulnerability8.8 High
- wekanWekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)6.5 Medium
- grokability snipe-itSnipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover7.1 High
- themetechmount truebooker – appointment booking and scheduler systemTrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter9.8 Critical
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.36.9 Medium
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.36.9 Medium
- go-vikunja vikunjaVikunja through 2.4.0 Principal-Type Confusion via LinkSharing7.7 High
- iqonic design kivicareKiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR6.5 Medium
- iqonic design kivicareKiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR4.3 Medium
- Show moreLoading…