CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- makeplane planePlane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization8.5 High
- makeplane planePlane: Cross-Tenant Cycle Issue Hijack via IDOR6.5 Medium
- makeplane planePlane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint5.4 Medium
- makeplane planePlane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces8.7 High
- makeplane planePlane: Cross-Tenant Issue Relation Creation via IDOR5.4 Medium
- makeplane planePlane: Cross-Workspace Project Modification via Unscoped Project Lookup6.8 Medium
- rapid7 velociraptorWatchEvent API streams another organization's live events4.9 Medium
- makeplane planePlane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users6.5 Medium
- makeplane planePlane: Cross-Tenant Module Issue Linking via IDOR4.3 Medium
- phoca cart, phoca.cz phoca cart extension for joomla +1 moreJoomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.88.7 High
- ahmad js help deskWordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- ahmad js help deskWordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- unknown upi qr code payment gatewayUPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery5.3 Medium
- imaginate solutions file uploads addon for woocommerceFile Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure5.9 Medium
- kishor-23 food-waste-management-systemkishor-23 food-waste-management-system Role Attribute admin.php authorization5.3 Medium
- razorpay for woocommerce, unknown razorpay for woocommerce +1 moreRazorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR5.3 Medium
- omega solution coinex cryptoOmega Solution CoinEx Crypto Customer Information API customer-currency authorization5.3 Medium
- omega solution coinex cryptoOmega Solution CoinEx Crypto Customer Profile API customer authorization5.3 Medium
- ultimate member memberWordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability8.8 High
- wpcodefactory helpdesk support ticket system for woocommerceHelpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter4.3 Medium
- uvdesk support-center-bundle, community-skeleton +1 moreUVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint5.3 Medium
- triggerdotdev trigger.devTrigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint5.3 Medium
- triggerdotdev trigger.devTrigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name8.3 High
- publishpress seriesWordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- yeswikiYesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche8.3 High
- yeswikiYesWiki before 4.6.7 Authorization Bypass via Comments API editComment7.1 High
- thimpress learnpressWordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- monetizemore advanced adsWordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability4.3 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability5.3 Medium
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter5.3 Medium
- villatheme photo reviews for woocommerceWordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- pete nelson rest api logWordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- wpfunnelsWordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- magepeople inc. bus ticket booking with seat reservationWordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- metagauss profilegridWordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- ahmad majestic support, majestic support support +1 moreWordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- tryghost ghostGhost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like7.1 High
- n8n-io n8nn8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint7.1 High
- n8n-io n8nn8n before 1.123.80 Credential Tampering via Duplicate Node IDs5.8 Medium
- n8n-io n8nn8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection8.3 High
- pandora fms fmsMissing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure7.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users'...5.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading...6.5 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter7.5 High
- unknown payments for hubtelPayments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR5.3 Medium
- croixhaug simply schedule appointmentsSimply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter6.5 Medium
- No product listeddeeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in...9.1 Critical
- accellion kiteworks, kiteworks core +1 moreKiteworks Core user impersonation in a file-request feature4.6 Medium
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway Incorrect Authorization6.5 Medium
- yii2-starter-kityii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download6.9 Medium
- Show moreLoading…