CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- getrebuild rebuildREBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint5.3 Medium
- siteserver sscmsSiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API5.1 Medium
- beikeshopBeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint5.3 Medium
- zhimaai chatwikiChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints5.3 Medium
- zoujingli think-plugs-adminThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit5.1 Medium
- kerwincui fastbeeFastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints5.3 Medium
- risesoft-y9 digital-infrastructureRisesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController7.1 High
- rocboss paopao-ceRocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint7.1 High
- build-admin buildadminBuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter5.1 Medium
- pickmall lilishopPickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}5.3 Medium
- zmister2016 mrdocMrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint5.3 Medium
- kuaifan dootaskDooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs5.3 Medium
- aureuserpAureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id5.3 Medium
- colinin abp-next-adminabp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations5.3 Medium
- iotsharpIoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs5.3 Medium
- tduckcloud tduck-survey-formTDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}5.3 Medium
- o2oaO2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint6.0 Medium
- oqtane frameworkOqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API6.9 Medium
- gz-yami mall4cloudMall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint7.1 High
- devlive-community datacapDataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials7.1 High
- roncoo roncoo-educationroncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints5.3 Medium
- b3log soloB3log Solo through 4.4.0 Missing Authorization in ArticleConsole5.3 Medium
- open journal systems journal systems, pkp open journal systems +1 morePKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription5.1 Medium
- jeequan jeepayJeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}2.3 Low
- jeequan jeepayJeepay through 3.2.9 IDOR via POST /api/mch/payConfigs7.1 High
- dromara jpomJpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController8.6 High
- elunez eladmineladmin through 2.7 Broken Access Control via /api/users Update and Delete5.1 Medium
- playeduPlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints5.3 Medium
- tandoorrecipes recipesTandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport5.4 Medium
- open-zaakOpen Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token6.5 Medium
- wpmu dev smartcrawlWordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- sfm software technologies inc. costifierIDOR in SFM Software's Costifier6.5 Medium
- wpmanageninja fluentcart a new era of ecommerce – faster, lighter, and simplerFluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters7.5 High
- dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsyDokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/doka…4.3 Medium
- classroomioClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes6.1 Medium
- cool-team-official cool-admin-midwaycool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints8.6 High
- cool-team-official cool-admin-midwaycool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints7.0 High
- mindoc-org mindocMinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch7.1 High
- dataelement bishengBISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox7.1 High
- crmebCRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift7.1 High
- mettle sendportal-coreSendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form5.3 Medium
- zhontai admin.corezhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints5.3 Medium
- crmeb javacrmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints2.3 Low
- metasfreshmetasfresh through 5.175 Authorization Bypass via /rest/api/board REST API2.3 Low
- likeshopLikeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints5.3 Medium
- easysoft zentaopmsZenTao PMS through 22.6 Authorization Bypass via action::editComment5.3 Medium
- polonel trudeskTrudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id5.3 Medium
- apitableAPITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description5.3 Medium
- dokployDokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router5.3 Medium
- lejianwen rustdesk-apirustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo6.9 Medium
- Show moreLoading…