CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- notfound shuffleShuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation8.6 High
- dfir-iris iris-webIRIS through 2.4.29 Unauthorized Comment Access via Object ID7.1 High
- continew-org continew-adminContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController7.1 High
- scada-ltsScada-LTS DWR Authorization Bypass - Systemic8.8 High
- tduckcloud tduck-survey-formTDuck survey form through 5.0 Unauthorized Data Modification7.1 High
- adenion blog2socialBlog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post5.3 Medium
- adenion blog2socialBlog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler5.3 Medium
- zlt2000 microservices-platformmicroservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check7.2 High
- zlt2000 microservices-platformmicroservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center7.1 High
- apache apache-airflow-providers-akeyless, apache software foundation airflow akeyless provider +1 moreApache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key6.5 Medium
- unknown kboardKBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR5.3 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR5.3 Medium
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter7.5 High
- niaefeup tts-be`tts-be` application has a Broken Access Control vulnerability7.5 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on…2.1 Low
- go-vikunja vikunjaVikunja before 2.6.0 Privilege Escalation via Link Share Hash8.7 High
- go-vikunja vikunjaVikunja before 2.6.0 Broken Object-Level Authorization via task-position5.3 Medium
- go-vikunja vikunjavikunja before 2.6.0 Team Enumeration via Project Share5.3 Medium
- flowiseai flowiseFlowise before 3.1.4 Authorization Bypass via openai-realtime7.6 High
- dromara jpomJpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list5.3 Medium
- mispMISP Collection Element Add Missing Authorization on Referenced Object UUID7.1 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter6.5 Medium
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system adminappview.php session_start authorization6.9 Medium
- charmbracelet soft-serveSoft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks5.3 Medium
- gamonoid icehrmIceHRM before 36.0.0 Broken Access Control via Employee ID7.1 High
- No product listedAn issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the...6.5 Medium
- zfile-dev zfileZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint8.7 High
- apache software foundation storm nimbusApache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys9.1 Critical
- mattermost, mattermost server +1 moreMissing property field ownership validation in Playbooks run property update endpoint6.5 Medium
- mattermost, mattermost server +1 morePlaybooks channel action update validation issue5.0 Medium
- code-projects inventory management systemSourceCodester Inventory Management System invoice.php authorization5.3 Medium
- jaygajera17 e-commerce-project-springbootjaygajera17 E-commerce-project-springBoot UserController.java UserController.updateUser authorization5.3 Medium
- jaychouchannel tourism-management-systemjaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization5.3 Medium
- phpgurukul bank locker management systemPHPGurukul Bank Locker Management System view-assign-locker.php authorization6.9 Medium
- rtcamp rtmedia for wordpress, buddypress and bbpressrtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR4.2 Medium
- wwbn avideoWWBN AVideo Missing Authorization via Playlists_schedules list.json.php5.3 Medium
- wwbn avideoWWBN AVideo Missing Authorization via remindMe.json.php5.3 Medium
- flowiseai flowiseFlowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method6.1 Medium
- unknown rox appointment bookingRox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR5.3 Medium
- realmag777 bearBEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR2.2 Low
- unknown masteriyo lmsMasteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR2.7 Low
- unknown booking for appointments and events calendarAmelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover7.2 High
- zoneminderCross-monitor event media authorization bypass in direct event media endpoints6.5 Medium
- concrete cms cms, concretecms concrete cms +1 moreIncorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object5.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreIn Concrete CMS below 9.5.3, Page Type update omits object-level authorization5.1 Medium
- brainstorm force starter templatesWordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- anh tran slim seoWordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- expresstech systems quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- moxi624 mogublogMoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity5.3 Medium
- moxi624 mogublogMoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check8.7 High
- Show moreLoading…