CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- unknown photo gallery, sliders, proofing and themesNextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR3.1 Low
- argoproj argo-workflowsArgo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector8.3 High
- grimmory-tools grimmorygrimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization5.3 Medium
- themefic hydra booking — appointment scheduling & booking calendarHydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR5.5 Medium
- themefic hydra booking — appointment scheduling & booking calendarHydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR4.7 Medium
- themefic hydra booking — appointment scheduling & booking calendarHydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR3.8 Low
- unknown online scheduling and appointment booking systemBookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR4.8 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter6.5 Medium
- 1panel-dev cordyscrmCordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts5.8 Medium
- 1panel-dev cordyscrmCordysCRM SSE Notification Stream Hijack via `/sse/subscribe`9.3 Critical
- syslifters sysreptorSysReptor: Unauthorized file disclosure by broken access control in writable shared notes4.2 Medium
- zoriya kyooKyoo: Transcoder serves uncataloged files from the media directory4.3 Medium
- hargata lubelogLubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership Check7.1 High
- mongodb mongoidCross-principal document update, theft, and deletion via unvalidated id in nested attributes8.6 High
- arnasdon wacrmWACRM: Database-layer authorization bypasses9.9 Critical
- frain-dev convoyConvoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials7.1 High
- mealie-recipes mealieMealie before 3.21.0 Information Disclosure via Ratings Endpoint5.3 Medium
- dataease sqlbotSQLBot through 1.10.1 Improper Access Control via Dashboard Update7.1 High
- techin2b applicationBroken Access Control in TECHIN2B Application8.8 High
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressLatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers,…4.3 Medium
- codename065 download managerDownload Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter6.5 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR2.7 Low
- easyappointments easy appointmentsEasy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR5.3 Medium
- magnigenie restropressRestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery6.5 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR3.8 Low
- devolutions serverAfter guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve...3.1 Low
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressLatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter4.3 Medium
- microsoft azure container registryMicrosoft Container Registry Elevation of Privilege Vulnerability10.0 Critical
- labredescefetrj wegiaWeGIA: Authorization Bypass via Empty Resource Array in InternoControle8.8 High
- wpengine faustjsFaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope8.8 High
- boxy studio cookedWordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- kingaddons.com king addons for elementorWordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- team-alembic ash authenticationConfirmation token accepted on any record in AshAuthentication7.6 High
- quadlayers checkout field manager (checkout manager) for woocommerceCheckout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting4.3 Medium
- stylemixthemes motorsMotors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure5.3 Medium
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel3.7 Low
- djust-org djustdjust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path6.3 Medium
- djust-org djustdjust has broken object-level access control (IDOR)7.1 High
- djust-org djustdjust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)7.4 High
- n8n-io n8nn8n before 1.123.76 Improper Authorization via Source Control Push5.9 Medium
- wwbn avideoAVideo through 29.0 API get_api_video Broken Access Control via clean_title8.7 High
- prestashop blockwishlistPrestaShop blockwishlist through 3.0.2 Information Disclosure5.3 Medium
- prestashop psgdprPrestaShop psgdpr through 1.4.3 GDPR Log Forgery5.3 Medium
- triggerdotdev trigger.devTrigger.dev before 4.6.0 GitHub App Installation Takeover7.1 High
- archerysecArcherySec through 2.0.6 Information Disclosure via WebScanVulnList7.1 High
- metasfreshmetasfresh Unauthorized Access via Document Attachments and Comments Endpoints8.7 High
- @tinacms auth, tinacms next-tinacms-azure, tinacms +2 moreTina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site8.8 High
- cisco secure firewall management center (fmc)Cisco Secure Firewall Management Center Software Low Privileged Arbitrary File Download Vulnerability7.7 High
- tanium threat responseTanium addressed an improper access controls vulnerability in Threat Response.6.3 Medium
- simac myphrSIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}8.7 High
- Show moreLoading…