CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- ph7software ph7builderpH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action5.3 Medium
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability5.3 Medium
- groundhogg hollerboxWordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- akin software computer import-export industry and trade co. ltd. octocloudIDOR in AKIN Software's OctoCloud8.8 High
- unknown wallet system for woocommerceWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR6.3 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR6.5 Medium
- unknown appointment booking pluginLatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR5.3 Medium
- unknown appointment booking pluginLatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR2.7 Low
- unknown appointment booking pluginLatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API3.3 Low
- unknown image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR2.7 Low
- red hat hardened images, satellite 6 +1 moreRubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass5.4 Medium
- red hat hardened images, satellite 6 +1 moreRubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass4.3 Medium
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification5.4 Medium
- splunk, splunk enterprise +1 moreAuthorization Bypass in SPL2 Module Permissions in Splunk Enterprise4.3 Medium
- splunk, splunk enterprise +1 moreImproper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise6.5 Medium
- gophishGophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints7.1 High
- wger-project wgerwger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry6.5 Medium
- unknown yaad sarig payment gateway for wcYaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR4.3 Medium
- kodezen llc academy lmsAcademy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers4.3 Medium
- kodezen llc academy lmsAcademy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint4.3 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities7.6 High
- giteaGitea issue attachment API allows changing comment attachments4.3 Medium
- aws qnabot-on-awsAuthorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS7.1 High
- arista networks cloudvision cueSecurity Advisory 01906.8 Medium
- elastic elasticsearchAuthorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure7.1 High
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception8.8 High
- payloadcms payloadPayload: Field-level write access bypass in Payload on MongoDB7.1 High
- @payloadcms storage-s3, payloadcms payload +1 morePayload: Client uploads could overwrite S3 objects7.1 High
- payloadcms payloadPayload: Unauthorized update to collection documents9.8 Critical
- payloadcms payloadPayload: Polymorphic join queries could disclose hidden fields7.1 High
- djangoproject djangoPrivilege abuse in model formsets with editable primary keys5.3 Medium
- webkul qloappsQloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms5.3 Medium
- wappointment team wappointmentWordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- zweischneider faktur pro for woocommerceWordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- No product listedPickMall Lilishop Buyer Invoice List receipt authorization5.3 Medium
- langgenius difyDify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers7.1 High
- vllmvLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`4.2 Medium
- vllmvLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features6.5 Medium
- os4ed opensis-classicopenSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)9.3 Critical
- langflow-ai langflowLangflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers7.1 High
- langflow-ai langflow, langflow-base +1 moreLangflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints5.4 Medium
- penpotPenpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create5.4 Medium
- makeplane planePlane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane9.8 Critical
- themeisle ai chatbot for wordpress – hyve liteWordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability6.9 Medium
- cozythemes cozy blocksWordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability6.9 Medium
- makeplane planePlane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)9.6 Critical
- makeplane planePlane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope7.1 High
- makeplane planePlane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure7.5 High
- makeplane planePlane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup7.1 High
- makeplane planePlane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints7.1 High
- Show moreLoading…