CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- diem-project diemdiem-project diem dmWidget BasedmWidgetActions.class.php authorization6.9 Medium
- learndash memberdashMemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter9.8 Critical
- siyuan-note siyuanSiYuan before v3.8.2 Information Disclosure via Attribute-View7.1 High
- siyuan-note siyuanSiYuan before v3.8.2 Private Attribute View Key Enumeration5.3 Medium
- netbox-community netboxNetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs5.3 Medium
- makeplane planePlane through 1.4.2 Arbitrary Comment Write via Public Deploy Board5.3 Medium
- bookwyrm-social bookwyrmBookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records7.1 High
- bookwyrm-social bookwyrmBookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints5.3 Medium
- bookwyrm-social bookwyrmBookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses7.1 High
- themeum kirkiKirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR2.2 Low
- unknown accept stripe paymentsAccept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR5.3 Medium
- unknown smart postPost Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR2.7 Low
- jofpin trapejofpin trape user.py authorization6.9 Medium
- solidinvoiceSolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint4.9 Medium
- mckaywrigley chatbot-uiChatbot UI Cross-User Private File Content Disclosure via Retrieval API7.1 High
- triggerdotdev trigger.devTrigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay8.4 High
- blinkospace blinkoBlinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList7.1 High
- blinkospace blinkoBlinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router8.7 High
- grokability snipe-itsnipe-it before 8.6.3 Authorization Bypass via Bulk Delete8.7 High
- grokability snipe-itSnipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance8.4 High
- openpanel-dev openpanelOpenpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts5.3 Medium
- openpanel-dev openpanelOpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures5.3 Medium
- traefikTraefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware7.0 High
- siyuan-note siyuanSiYuan before v3.8.2 Information Disclosure via undoState5.3 Medium
- sc internet vivoo wp rentalsWordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- unknown wpfunnelsWPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution5.3 Medium
- radiustheme classified listingClassified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR7.1 High
- light0011 cmslight0011 cms Chapter Controller ChapterController.class.php authorization6.9 Medium
- light0011 cmslight0011 cms Chapter Controller ChapterController.class.php _initialize authorization6.9 Medium
- microsoft azure cosmos dbAzure Cosmos DB Spoofing Vulnerability8.5 High
- microsoft azure active directory b2c, entra +1 moreMicrosoft Azure Active Directory B2C Elevation of Privilege Vulnerability10.0 Critical
- peppermint lab peppermintPeppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint5.3 Medium
- worklenzWorklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints7.1 High
- brainstorm force sureformsWordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- kirillbdev wc ukraine shippingWordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability7.1 High
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- suse rancherRancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass7.1 High
- suse rancherRancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing7.7 High
- suse rancherRancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole8.7 High
- suse rancherRancher: Identity-field mutation in /v3/users allows account hijack via principal rebind6.1 Medium
- lenve vhrvhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite7.2 High
- humansignal label-studioLabel Studio through 1.23.0 Cross-Organization Storage URI Resolution8.3 High
- lenve vhrvhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change7.7 High
- heliconeHelicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter8.3 High
- crmebCRMEB through 6.0.0 Unauthorized Message Modification via edit_message5.3 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.67.1 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.68.8 High
- n8nn8n before 2.36.2 Missing Authorization via Insights API5.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Session Management s71.py _sess_nowait authorization6.9 Medium
- Show moreLoading…