CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- dromara lamp-cloudlamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById7.1 High
- tduckcloud tduck-survey-formTDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create5.3 Medium
- tduckcloud tduck-survey-formTDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}7.1 High
- dassault systèmes tuleap enterprise editionAuthorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.58.1 High
- bastien ho event postWordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- nicdark hotel bookingHotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR4.3 Medium
- red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9, satellite 6.17 for rhel 9 +1 more +3 moreForeman: api filter lookup ignores a search-limited filter permission6.5 Medium
- zkteco biotimeZKTeco BioTime Employee REST API employees authorization5.3 Medium
- zkteco biotimeZKTeco BioTime Biometric Data Endpoint finger_data authorization5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter5.3 Medium
- iflytek astron-agentiFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint2.3 Low
- apiparklab apiparkAPIPark through 1.9.7-beta IDOR via application authorization endpoints6.0 Medium
- unicomai wanwuUnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting2.3 Low
- unicomai wanwuWanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key5.3 Medium
- unicomai wanwuUnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app7.2 High
- alextselegidis easyappointmentsEasy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint8.8 High
- lightdashLightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion2.3 Low
- syliusSylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint6.9 Medium
- librenmsLibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php5.3 Medium
- berriai litellmBerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization5.3 Medium
- unknown envira galleryEnvira Gallery < 1.16.2 - Author+ IDOR via Shortcode2.7 Low
- coreshopCoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship5.3 Medium
- 1panel-dev cordyscrmCordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints5.3 Medium
- wukongopensource wukong aicrmWukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter5.3 Medium
- openlitOpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Header6.0 Medium
- iflytek astron-rpaAstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var7.1 High
- opensource-socialnetworkOpen Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route7.1 High
- webtoffee woocommerce pdf invoices, packing slips, delivery notes & shipping labelsWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parame…7.5 High
- themeum tutor lmsTutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR6.5 Medium
- awordpresslife portfolio filter galleryPortfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail2.2 Low
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item…4.3 Medium
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String /…6.8 Medium
- civiformCiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email4.5 Medium
- jexactylJexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)5.4 Medium
- contaoContao: Improper access control in the preview links module4.3 Medium
- aws aws-amplify/data-construct, aws-amplify/graphql-api-construct, aws-amplify/graphql-index-transformer +2 moreImproper authorization in query resolvers for SQL-backed models in AWS Amplify API Category7.1 High
- himovo movoMOVO through 0.2.3 Authorization Bypass via Document Endpoints7.6 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an...4.3 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an...7.1 High
- mongodb ops managerOps Manager Improper Authorization in Daily Host Monitoring Retrieval2.3 Low
- microsoft bookingsMicrosoft Bookings Elevation of Privilege Vulnerability9.9 Critical
- banq jivejdonJivejdon through 5.0 IDOR via subSaveAction Subscription Delete5.3 Medium
- webkul qloappsQloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking5.3 Medium
- zimbra collaboration suiteZimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier6.5 Medium
- Show moreLoading…