CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- francoisjacquet rosariosisRosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers5.3 Medium
- cervantessec cervantesIDOR: User reads and modifies findings from other people's projects4.3 Medium
- cervantessec cervantesBOLA Allows Cross-Project Target Tampering5.4 Medium
- No product listedScada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization5.3 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR4.3 Medium
- synacor zimbra collaboration suite, zimbra collaboration suite +1 moreZimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records4.3 Medium
- chatwootChatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id2.3 Low
- okta access gatewayAuthentication Source Verification Issue in Okta Access Gateway8.1 High
- marcoscamara01 ecommerce templateCross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries7.1 High
- filecoin-project lotusLotus through 0.10.2 Authorization Bypass via switch_organization Endpoint7.6 High
- filecoin-project lotusLotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet6.0 Medium
- webkul qloappsQloApps through 1.7.0 IDOR via OrderDetailController Refund Request5.3 Medium
- gravitl netmakerNetmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup8.7 High
- bytebaseBytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers5.3 Medium
- bytebaseBytebase before 3.16.0 Authorization Bypass via UpdateIssueComment5.3 Medium
- mycredWordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability5.4 Medium
- jordy meow photo engine (media organizer & lightroom)Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR4.9 Medium
- unknown fluentcart a new era of ecommerceFluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR5.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab4.3 Medium
- splunk, splunk enterprise +1 moreAuthorization Bypass in the Data Management REST API in Splunk Enterprise5.4 Medium
- h5pWordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- polonel trudeskTrudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send5.3 Medium
- polonel trudeskTrudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs5.3 Medium
- polonel trudeskTrudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints5.3 Medium
- polonel trudeskTrudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid6.9 Medium
- chamilo chamilo-lmsChamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade5.3 Medium
- unknown pricing table wordpress pluginEasy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication5.5 Medium
- unknown kliken: ads + pixel for metaKliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR5.3 Medium
- unknown wpzoom portfolio liteWPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR4.9 Medium
- unknown smartyparcelSmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR5.3 Medium
- unknown appointment booking pluginLatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR2.7 Low
- triggerdotdev trigger.devTrigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route6.0 Medium
- triggerdotdev trigger.devTrigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup7.2 High
- triggerdotdev trigger.devTrigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV46.1 Medium
- triggerdotdev trigger.devTrigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint7.2 High
- triggerdotdev trigger.devTrigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints7.2 High
- openchoreoOpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs7.4 High
- modelcontextprotocol typescript-sdkMCP TypeScript SDK: Experimental tasks were not tied to the session that created them8.6 High
- espocrmEspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization5.3 Medium
- xnau webdesign participants databaseWordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability6.3 Medium
- apostrophecms apostropheApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints3.7 Low
- apostrophecms apostropheApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization4.3 Medium
- vatesfr xen-orchestraXen Orchestra before 6.9.0 Authorization Bypass via user.set API5.3 Medium
- stirling-tools stirling-pdfStirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders7.1 High
- x402-foundation @x402/extensions, x402, github.com/x402-foundation/x402/go/v2 +2 morex402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource6.9 Medium
- fatfreecrm fat free crmFat Free CRM before 0.26.0 IDOR via CommentsController update and destroy5.3 Medium
- modoboaModoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation5.3 Medium
- modoboaModoboa before 2.8.0 IDOR via API v2 alarms bulk_delete5.3 Medium
- blinkospace blinkoBlinko through 1.8.8 IDOR via Tag tRPC Router Procedures5.3 Medium
- webstudio-is webstudioWebstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds2.3 Low
- Show moreLoading…