CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- unknown booking managerBooking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR4.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint5.4 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR4.3 Medium
- payment plugins for paypal woocommerce, unknown payment plugins for paypal woocommerce +1 morePayment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID6.5 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint4.3 Medium
- tribulant software newslettersNewsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR6.5 Medium
- photoviewPhotoview through 2.4.0 Authorization Bypass via shareAlbum7.1 High
- github enterprise serverAuthorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision6.0 Medium
- unleashUnleash: Missing await on permission check + cross-project IDOR in admin API7.1 High
- unleashUnleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log4.3 Medium
- unleashUnleash: Clone-feature lets a user copy a feature from a project they cannot read5.3 Medium
- nautobotNautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs6.4 Medium
- spreeSpree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)7.1 High
- novuhq novu, @novu api-service +1 moreNovu: Cross-Environment Integration Manipulation (IDOR)6.5 Medium
- webkul aureus erpAureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel8.6 High
- mispMISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL5.3 Medium
- kompini tankuam placesDirect references to unsafe objects (IDOR) in Tankuam Places by Kompini9.3 Critical
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter4.3 Medium
- hiroaki miyashita custom field templateCustom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter4.3 Medium
- dromara lamp-cloudlamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource5.3 Medium
- dromara lamp-cloudlamp-cloud through 5.10.0 Unauthorized Notification Deletion7.1 High
- dromara lamp-cloudlamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints7.1 High
- dromara lamp-cloudlamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file7.1 High
- dromara lamp-cloudlamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById7.1 High
- laurent22 joplinJoplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID6.5 Medium
- 1panel-dev maxkbMaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base5.4 Medium
- 1panel-dev maxkbMaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation6.5 Medium
- 1panel-dev maxkbMaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path5.4 Medium
- 1panel-dev maxkbMaxKB: Cross-workspace model parameter form write7.4 High
- inventreeInvenTree: Report/Label print endpoints ignore per-model permissions4.3 Medium
- inventreeInvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role6.5 Medium
- inventreeInvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings4.3 Medium
- jishenghua jsherpjshERP through 3.6 Unauthorized Access via by-id Endpoints8.7 High
- jishenghua jsherpjshERP through 3.6 Tenant Information Disclosure via GET /tenant/info5.3 Medium
- graylog2 graylog2-serverGraylog: Manager-to-Owner privilege escalation on saved searches and dashboards6.3 Medium
- sysadminsmedia homeboxHomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching8.1 High
- sysadminsmedia homeboxHomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox8.1 High
- sysadminsmedia homeboxHomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack8.1 High
- hatchet-dev hatchetHatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter4.3 Medium
- hatchet-dev hatchetHatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher3.1 Low
- gocdGoCD is vulnerable to authorization bypass via material connection test APIs4.9 Medium
- gocdGoCD before 26.1.0 is vulnerable to authorization bypass via job status API4.3 Medium
- uvdesk core-framework, community-skeleton +1 moreUVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply5.3 Medium
- mispMISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport6.4 Medium
- henrygd beszelBeszel before 0.19.0 Insecure Direct Object Reference via user-alerts2.3 Low
- mispMISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports8.3 High
- omega solution fbp fulfillment by peopleOmega Solution FBP Fulfillment by People User Profile API user authorization5.3 Medium
- unknown photo gallery, sliders, proofing and themesNextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update3.1 Low
- unknown photo gallery, sliders, proofing and themesNextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR4.2 Medium
- unknown photo gallery, sliders, proofing and themesNextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR2.7 Low
- Show moreLoading…