CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft skype for business server 2015 cu13, skype for business server 2019 cu8, skype for business server subscription edition cu1 +2 moreSkype for Business Elevation of Privilege Vulnerability6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreMicrosoft PowerShell Security Feature Bypass Vulnerability8.8 High
- zofe rapyd-adminRapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component8.7 High
- webkul qloappsQloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation5.3 Medium
- stonewuu ai-fusion-videoai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints5.3 Medium
- fushengqian fuintcateringfuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail7.1 High
- wayn111 waynboot-mallwaynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints5.3 Medium
- wayn111 waynboot-mallwaynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints5.3 Medium
- wayn111 waynboot-mallwaynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints5.3 Medium
- kerwincui fastbeeFastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints8.6 High
- pickmall lilishopPickMall lilishop through 4.4 IDOR via Goods Freight Endpoint5.3 Medium
- pickmall lilishopPickMall lilishop through 4.4 IDOR via Goods Edit Endpoint7.1 High
- guchengwuyue yshopmallyshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController5.3 Medium
- guchengwuyue yshopmallyshopmall through 2.0.0 IDOR via Member Address API in UserAddressController7.1 High
- risesoft-y9 workflow-engineWorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints7.1 High
- sanluan publiccmsPublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint5.3 Medium
- dromara ruoyi-cloud-plusRuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}2.3 Low
- dromara ruoyi-vue-plusRuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}2.3 Low
- joraniJorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests5.3 Medium
- makeplane planePlane: Unauthenticated Workspace Invitation Token Leakage6.5 Medium
- froxlorFroxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php5.3 Medium
- espocrmEspoCRM before 10.0.7 IDOR via Import attachmentId Parameter5.3 Medium
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices...5.3 Medium
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices...7.1 High
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices...8.7 High
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization6.9 Medium
- No product listedProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference...10.0 Critical
iperf3AlpaquitaGiftcard enumeration5.3 Medium- frappe suiteFrappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs5.3 Medium
- marceauka shaarkShaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes7.1 High
- weebzone telegram-stremioTelegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs7.1 High
- getkirby kirbygetkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization5.3 Medium
- temporal technologies, inc. serverTemporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state6.0 Medium
- the-40-thieves obsidian-tcobsidian-tc tokens can access arbitrary configured vaults9.9 Critical
- surrealdbSurrealDB before 3.3.0 Cross-Tenant Access via USE Statement8.6 High
- surrealdbSurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use8.6 High
- admidioAdmidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php8.5 High
- parse-community parse-serverParse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query5.3 Medium
- open-webuiOpen WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes5.3 Medium
- open-webuiOpen WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID5.3 Medium
- red hat quay 3Quay: repository auto-prune policy uuid idor in quay api3.1 Low
- red hat quay 3Quay: build trigger uuid idor in quay api6.4 Medium
- thirty bees beesThirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout9.1 Critical
- webkul qloappsQloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers5.3 Medium
- jishenghua jsherpjshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs5.3 Medium
- moxi624 mogublogMoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit5.3 Medium
- moxi624 mogublogMoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files5.3 Medium
- moxi624 mogublogMoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList5.3 Medium
- dromara lamp-cloudlamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId7.1 High
- tduckcloud tduck-survey-formTDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save5.3 Medium
- Show moreLoading…