CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- baserowBaserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint5.3 Medium
- unblu inc. sparkUnblu Spark Authorization Bypass in Configuration Cascade Operations9.3 Critical
- thimpress learnpressLearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers5.3 Medium
- opencatsOpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent5.3 Medium
- grafana enterpriseCross-organization user modification and deletion via the SCIM API in Grafana Enterprise6.7 Medium
- typo3 extension "analytics"Insecure Direct Object Reference in extension "Analytics" (analytics)5.3 Medium
- typo3 extension "typo3 fluid-form by coding.ms"Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)6.3 Medium
- letta-ai lettaLetta through 0.16.8 Cross-Tenant Impersonation via user_id Header8.6 High
- bytedance coze-studioCoze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers8.7 High
- ibm langflow oss, langflow +1 moreLangflow OSS Authorization Bypass Through User-Controlled Key8.3 High
- camunda 7Camunda Missing Authorization in Task Sub-Resources8.6 High
- sunkaifei flycmsFlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint5.3 Medium
- krayin laravel-crmKrayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module7.1 High
- krayin laravel-crmKrayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints7.1 High
- frappe helpdeskFrappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation5.1 Medium
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter5.3 Medium
- calcom cal.com, cal.diy +1 morecalcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization5.3 Medium
- giteaGitea release attachment re-linking of issue attachments6.3 Medium
- teableio teableTeable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint2.3 Low
- wp e-signature electronic signature add-on for fluent formsWordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- unknown modern events calendar liteModern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR6.5 Medium
- admidioAdmidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update7.1 High
- thorsten phpmyfaqphpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API8.7 High
- thorsten phpmyfaqphpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data7.0 High
- thorsten phpmyfaqphpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API6.9 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter4.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter7.5 High
- tandoorrecipes recipesTandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content8.1 High
- tandoorrecipes recipesTandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints7.1 High
- lingguoai lingguo-dramaLingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API8.6 High
- jingsewu open-wesOpen WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping5.3 Medium
- nduckmink arkonArkon through 0.9.2 Missing Authorization via Skills Versions API5.3 Medium
- nduckmink arkonArkon through 0.9.2 Broken Access Control via Sources By-ID Routes5.3 Medium
- nduckmink arkonArkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API5.3 Medium
- canove whaticket-communityWhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId5.3 Medium
- vastxie 99ai99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure6.9 Medium
- fushengqian fuintFuint through commit 57ec018 IDOR via bookId in myBookDetail5.3 Medium
- guchengwuyue yshop-crmyshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints5.3 Medium
- sugarforever chat-ollamaChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases8.7 High
- roinli huizhi-chargeos-cloudHUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge7.1 High
- roinli huizhi-chargeos-cloudHUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs7.1 High
- shaiwz data-platform-openShaiwz data-platform-open through commit efeacd3 IDOR in Datasource API7.1 High
- exrick xbootXBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint5.3 Medium
- absmach magistralaMagistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service7.2 High
- apiparklab apiparkAPIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter7.2 High
- faveosuite faveo-helpdeskFaveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint5.3 Medium
- hello-hao tbedTbed through 20240319 Missing Authorization via setImgFileName Endpoint5.3 Medium
- data-infra cube-studioCube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints5.3 Medium
- data-infra cube-studioCube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints7.1 High
- Show moreLoading…