CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- energizelab nestjs auth serviceEnergizeLab Eilik User-ID Mass Assignment Account Takeover8.8 High
- temporal technologies, inc. temporal-proxytemporal-proxy payload decryption is not bound to the request namespace6.0 Medium
- suitenumerique docsLa Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation2.3 Low
- elextensions elex woocommerce advanced bulk edit products, prices & attributesWordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability6.3 Medium
- lycheeorg lycheeLychee: Album password bypass in ZIP downloads8.2 High
- espocrmEspoCRM: Mass email template renderer leaks restricted record fields6.5 Medium
- espocrmEspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record4.3 Medium
- webba appointment booking bookingWordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- eclipse foundation connected services platformIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver...7.5 High
- qnap video stationAccess Code Forgery in Video Station leading to unauthorized media access8.7 High
- pr-gateway blog2social: social media auto post & schedulerSocial Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure4.3 Medium
- n8n-io n8nn8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON7.1 High
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint6.1 Medium
- n8n-io n8nn8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval6.1 Medium
- tp-link system inc. omada software controller (windows)Insufficient Authorization and User Boundary Validation in Omada Controller MSP7.5 High
- error311 fileriseFileRise renameFolder omits destination-parent authorization5.4 Medium
- openaev-platform openaevOpenAEV has unauthenticated access and missing object-level authorization on player lessons API8.2 High
- makeplane planePlane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope6.5 Medium
- makeplane planePlane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/8.1 High
- invoiceshelfInvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)7.6 High
- invoiceshelfInvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates7.1 High
- invoiceshelfInvoiceShelf bulk deletion lacks company scoping7.2 High
- modelengine-group nexentNexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access7.1 High
- blinkospace blinkoBlinko through 1.8.8 Private Attachment Read via /api/file Route6.0 Medium
- shopizerShopizer through 3.2.5 Authorization Bypass via Product Review customerId5.3 Medium
- iflytek astron-rpaAstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download6.0 Medium
- zuihou lamp-bootlamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany5.3 Medium
- servicenext sertecServiceNext Insecure Direct Object Reference via GetUsarios8.1 High
- giteaGitea private attachment disclosure through repository mismatch5.9 Medium
- formbricksFormbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId6.1 Medium
- youlaitech youlai-mallyoulai-mall through commit 9f62de8 Order Information Disclosure via App Order List7.1 High
- getrebuild rebuildREBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid6.0 Medium
- bizspring shop, java mall +1 moreBizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive5.3 Medium
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters7.5 High
- wisdomgarden tronclassWisdomGarden｜Tronclass - Insecure Direct Object Reference5.3 Medium
- wisdomgarden tronclassWisdomGarden｜Tronclass - Insecure Direct Object Reference5.3 Medium
- unknown cart abandonment recovery for woocommerceCart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR5.3 Medium
- unknown sifalo paySifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id5.3 Medium
- rtcamp rtmedia for wordpress, buddypress and bbpressrtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR4.3 Medium
- unknown wp 2faWP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR2.7 Low
- ruben garcia gamipressGamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure4.3 Medium
- basix nex-formsNEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter5.3 Medium
- tyche softwares abandoned cart pro for woocommerceAbandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter9.8 Critical
- arshidkv12 database addon for contact form 7 – cfdb7Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field5.3 Medium
- hypr passwordlessAuthorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows...6.9 Medium
- omnispace agora projectOmnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()8.6 High
- omnispace agora projectOmnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload8.7 High
- lowcoderCVE-2026-167538.8 High
- ente, ente ghcr.io/ente/server +1 moreEnte: Accepted emergency contact can bypass the recovery notice period7.1 High
- Show moreLoading…