CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- quivrhq quivrQuivr Chat Endpoints Missing Ownership Validation8.6 High
- voltagentVoltAgent Memory API Handlers Missing Ownership Checks8.6 High
- cinnamon kotaemonKotaemon Missing Ownership Check in Conversation Functions9.1 Critical
- quivrhq quivrQuivr Prompt Endpoints Missing Ownership Validation7.1 High
- sciphi-ai r2rR2R Missing Ownership Check Allows Modifying Other Users' Conversations7.1 High
- hatchet-dev hatchetHatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe6.4 Medium
- ahmad wp job portalWordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- unknown user registration & membershipUser Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR4.3 Medium
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR2.7 Low
alloyopenSUSE,amazon-cloudwatch-agentopenSUSE,azl-otel-collectorAzure Linux +30 more +32 moregrpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X...9.8 Critical- flowintelFlowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification7.2 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreRubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup5.4 Medium
- summit security systems adisyonproIDOR in Zirve Security's AdisyonPro6.5 Medium
- theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreForeman: cross-tenant disclosure of template revisions via unauthorized audit lookup6.5 Medium
- wibu-systems-ag codemeter-runtimeImproper Authentication of Session Handles7.7 High
- unknown notifimaNotifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR4.3 Medium
- unknown mobile app for woocommerce: shopapper mobile app builder service for woocommerceShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR4.3 Medium
- unknown document embedderDocument Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle5.3 Medium
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.15.3 Medium
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.15.1 Medium
- 1panel-dev kubepiKubePi: Insufficient per-cluster authorization checks in cluster management APIs5.8 Medium
- pleskInsecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3,...8.6 High
- seaweedfsSeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths7.6 High
- weblateorg weblateWeblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project8.1 High
- dell powerprotect oneDell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User...6.5 Medium
- idurar idurar-erp-crmIDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update8.6 High
- jowilf starlette-adminStarlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS5.4 Medium
- peterschulznl wp data access – app builder for tables, forms, charts, maps & dashboardsWP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access5.3 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR4.3 Medium
- unknown project managerWP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR4.3 Medium
- unknown booking for appointments and events calendarAmelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR4.7 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init5.3 Medium
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreKetello: katello content view history api cross-organization authorization bypass4.3 Medium
- No product listedAntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java...7.5 High
- baptistearno typebot.ioTypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain6.4 Medium
- airbytehq airbyte-platformAirbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId8.7 High
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana4.2 Medium
- miniorange.com saml sp single sign on – login with adfs extension for joomla, saml sso basic for joomla extension for joomla, saml sso enterprise for joomla extension for joomla +4 more +6 moreJoomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Si…10.0 Critical
- typo3 extension "apache solr for typo3 - enterprise search"Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)6.3 Medium
- typo3 extension "modules"Information Disclosure in extension "Modules" (modules)6.0 Medium
- typo3 extension "femanager"Information Disclosure in extension "femanager" (femanager)8.2 High
- typo3 extension "telephone directory"Broken Access Control in extension "Telephone Directory" (telephonedirectory)8.7 High
- typo3 extension "industry directory"Broken Access Control in extension "Industry Directory" (yellowpages2)8.8 High
- typo3 extension "club directory"Broken Access Control in extension "Club Directory" (clubdirectory)8.8 High
- typo3 extension "forum"Broken Access Control in extension "Forum" (pforum)8.8 High
- typo3 extension "events 2"Broken Access Control in extension "Events 2" (events2)7.1 High
- hookandhook wp courses lms – online courses builder, elearning courses, courses solution, education coursesWP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter4.3 Medium
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths6.8 Medium
- sakaiproject sakaiSakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image6.5 Medium
- dolibarrDolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes7.1 High
- Show moreLoading…