CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- the wikimedia foundation mediawiki wikilambda extensionWikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments7.4 High
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System Admin Area admin authorization5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template...4.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other...7.7 High
- wp hosting as pay with vipps for woocommerceWordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- radiustheme review schemaWordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- webba appointment booking bookingWordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- boldgrid client invoicing by sprout invoicesWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- omnisend newsletters, email marketing, sms and popups by omnisendWordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- nexcess givewpWordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- booklyWordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- 10up safe svgWordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- wp desk flexible pdf couponsWordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- yunohost-apps sogo yhnAuthentication Bypass in sogo_yhn9.2 Critical
- yunohost-apps sogo yhnAuthentication Bypass in sogo_yhn9.3 Critical
- mispMISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows8.3 High
- mispMISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events8.7 High
- gedelumbung hospitalmanagementgedelumbung HospitalManagement laporan_data_pasien.php detail authorization5.1 Medium
- beenuar aisocAiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP7.1 High
- surrealdbSurrealDB before 3.3.0 Cross-Tenant Access via Headers8.6 High
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.46.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.36.9 Medium
- owen2345 camaleon cmsowen2345 Camaleon CMS Media Crop media_controller.rb crop authorization5.3 Medium
- limesurveyLimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations7.1 High
- gestsupGestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter7.1 High
- No product listedmetatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP...9.1 Critical
- No product listedKitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in...4.3 Medium
- suse rancher, rancher fleet +1 moreCross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet7.1 High
- enocta educational technologies inc. platformImproper Authorization in Enocta Educational's Enocta Platform8.1 High
- apache software foundation rollerApache Roller: Cross-weblog resource tampering via unscoped authoring lookups7.7 High
- fuzui studentinfofuzui StudentInfo Password Change Endpoint moditypasswordstu authorization5.1 Medium
- krayin laravel-crmKrayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization6.9 Medium
- zhistaredu startrainingzhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization5.3 Medium
- tombursch kitchenowlKitchenOwl through 0.7.10 IDOR via unchecked category ID5.3 Medium
- unknown mailchimp for woocommerceMailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR5.3 Medium
- unknown online scheduling and appointment booking systemBookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR3.8 Low
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data6.3 Medium
- cap-go capgo.appcapgo through 12.128.2 IDOR via PUT /app icon endpoint5.3 Medium
- budibase serverBudibase server before 3.45.0 Cross-Tenant Information Disclosure7.1 High
- stoatchatstoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket7.1 High
- getgrav gravGrav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass8.7 High
- cap-go capgo.appCapgo bundle promotion API channel RBAC deny override bypass7.2 High
- cap-go capgo.appCapgo App Icon Update Privilege Escalation via Service-Role Worker8.7 High
- cap-go capgo.appCapgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker8.7 High
- cap-go capgo.appCapgo SSO Provider ID Authentication Bypass via Incomplete Migration8.6 High
- flowiseai flowiseFlowise through 3.1.4 Missing Authorization via upsert-history7.7 High
- flowiseai flowiseFlowise through 3.1.4 Insecure Direct Object Reference via Credential7.6 High
- openclawOpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester7.2 High
- Show moreLoading…