CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- openclawOpenClaw before 2026.8.1 Session Cancellation Authorization Bypass2.3 Low
- openclaw slackopenclaw Slack before 2026.8.1 Authorization Bypass7.1 High
- glpi-project glpiGLPI: Arbitrary Document Read via Form Context Authorization Bypass7.1 High
- zammadZammad: Authenticated agents can read AI summary error messages from inaccessible tickets2.3 Low
- zammadZammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data7.1 High
- zammadZammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration5.3 Medium
- zammadZammad: Channel admins can read unauthorized attachments via signature rich-text body5.1 Medium
- yzcheng90 x-springbootX-SpringBoot through 6.0 Authorization Bypass via User Management8.6 High
- zammadZammad: Cross-User Taskbar Item Access Control Vulnerability5.3 Medium
- bludit cmsBludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints5.3 Medium
- zammadZammad: Incorrect implementation of permission checks in the knowledge base module7.1 High
- invoiceplaneInvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check6.5 Medium
- ail project frameworkAil Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment6.3 Medium
- akiaBroken authorization in Akia keyless entry lets an authenticated guest unlock other rooms8.4 High
- booklyBookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass5.3 Medium
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter9.1 Critical
- sanluan publiccmsSanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization5.1 Medium
- cyber-iii student-management-systemningzichun student-management-system editLog.php authorization6.9 Medium
- cyber-iii student-management-systemningzichun student-management-system getStudent.php authorization6.9 Medium
- apache software foundation airflow hashicorp providerApache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key6.5 Medium
- chillzhuang springbladechillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization5.3 Medium
- docmostDocmost: Page export can include restricted same-space attachments through forged attachmentId4.3 Medium
- docmostDocmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces4.3 Medium
- mauriceboe trekTREK: Cross-user note-file deletion (IDOR / Broken Access Control)7.1 High
- termix-ssh termixTermix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint4.3 Medium
- termix-ssh termixTermix: Authenticated users can read other users' host status and clear global SSH connections5.4 Medium
- suitenumerique docsLaSuite Doc: Public Documents Enumeration6.5 Medium
- delta electronics diaenergieAuthorization Bypass Through User-Controlled Key in DIAEnergie4.3 Medium
- papercut ng/mfPaperCut MF/NG: User permissions are not evaluated on report generation6.9 Medium
- pixelite events managerEvents Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR2.7 Low
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR2.7 Low
- unknown masteriyo lmsMasteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR4.3 Medium
- kvcache-ai mooncakekvcache-ai mooncake RPC Path UnmountSegment authorization6.9 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle6.5 Medium
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 moreAutomation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter orac…6.5 Medium
- joomshaper.com easy store extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.08.2 High
- verbb formieFormie: Unauthenticated users can overwrite incomplete submissions via submit action8.2 High
- verbb formieFormie: Missing authorization on sent notification resend modal exposes submission PII7.7 High
- yith woocommerce request a quote, yithemes yith woocommerce request a quote +1 moreWordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- oleh radiustheme teamWordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- jordy meow ai engineWordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- siteskiteWordPress SiteSkite plugin <= 2.1.7 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- cinnamon kotaemonCinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers6.5 Medium
- claris filemaker serverAn authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed...9.1 Critical
- claris filemaker proA DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to...7.3 High
- webcon bpsIDOR in WEBCON BPS5.3 Medium
- invoiceshelfInvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover8.7 High
- zohocorp manageengine applications managerBroken Authentication vulnerability8.8 High
- zohocorp manageengine opmanager, manageengine firewall analyzer +1 moreBroken Access Control vulnerability7.1 High
- zohocorp manageengine opmanager, manageengine firewall analyzer +1 moreBroken Access Control vulnerability7.1 High
- Show moreLoading…