CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- shizen connect inc. shizenbox2 (edge-app)Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If...7.1 High
- jenkins project microsoft entra id (previously azure ad) pluginJenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants...8.8 High
- arraytics timeticsTimetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR3.8 Low
- publishpress permissionsWordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- craftcms cmsGQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete8.7 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass8.7 High
- unknown wc vendorsWC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR6.5 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR3.8 Low
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR2.7 Low
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter4.3 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas4.9 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API2.7 Low
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as2.7 Low
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure3.7 Low
- ruben garcia gamipressGamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners4.3 Medium
- jetmonsters motopress appointment bookingAppointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion5.3 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers6.4 Medium
- runzero platformrunZero MCP 'Findings summaries' Data Leak3.5 Low
- growi, inc. growiGROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval7.1 High
- manacle technologies multi-tenant erp systemInsecure Direct Object Reference Vulnerability in Manacle Technologies ERP System9.2 Critical
- invoice ninja ninja, invoiceninja invoice ninja +1 moreinvoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization5.3 Medium
- suluSulu: Media move/update authorization bypass (IDOR)5.3 Medium
- easycorp easyadminbundleEasyAdmin custom-action dispatcher bypasses access_control on other routes8.1 High
- ellite wallosWallos: Cross-user subscription cost inference via replacement_subscription_id4.3 Medium
- fosrl pangolinPangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint8.6 High
- mcphubMCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)7.7 High
- dibo-software dibootdibo-software diboot AI Session Endpoint ai-session authorization5.3 Medium
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.105.1 Medium
- tooljetToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db9.4 Critical
- tooljetToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export5.3 Medium
- tooljetToolJet before v3.16.208 Cross-Workspace Authorization Bypass7.1 High
- tooljetToolJet before v3.16.208 Cross-Tenant Database Manipulation7.0 High
- tooljetToolJet Database before v3.16.44 Privilege Escalation via join_tables8.2 High
- growi, inc. growiGROWI contains a vulnerability with an authorization bypass through user-controlled key in the...5.3 Medium
- soarkey studentmanagement, 学生信息管理系统 +1 moreSoarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization6.9 Medium
- ash-project ash phoenixAshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data2.3 Low
- ash-project ash adminAshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle2.3 Low
- seacmsSeaCMS ass.php authorization6.9 Medium
- ash-project ash aiIdentity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records7.1 High
- No product listedXueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher...6.5 Medium
- No product listedThe teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System ...8.1 High
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR2.7 Low
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR4.3 Medium
- graylog2 graylog2-serverGraylog token revocation endpoint allows authenticated users to delete other users’ access tokens5.3 Medium
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities6.4 Medium
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities8.2 High
- go-vikunja vikunjaVikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment5.0 Medium
- go-vikunja vikunjaVikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id7.1 High
- go-vikunja vikunjaVikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api8.1 High
- chainlitChainlit Feedback Endpoints Missing Ownership Validation6.0 Medium
- Show moreLoading…