CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- kubeflow pipelinesKubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads6.5 Medium
- nicdark hotel bookingWordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- eventprimeWordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability5.4 Medium
- elastic cloud enterpriseAuthorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation6.8 Medium
- idinging freemailFreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming7.2 High
- thinkgem jeesiteJeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module2.3 Low
- foxit software inc. foxit.comCross-user Document Access on Foxit Official Website's HTML-to-PDF Service7.5 High
- jordy meow photo engine (media organizer & lightroom)Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR4.9 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR4.3 Medium
- apereo foundation openequellaUnauthenticated IDOR Enables Disclosure of Other Users’ last-known details6.9 Medium
- maykinmedia open-objectObjects API: Cross-object-type authorization bypass on the object history-detail endpoint6.5 Medium
- mailwatchMailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail8.1 High
- invoiceplaneInvoicePlane: Guest user IDOR in quote approval and rejection5.3 Medium
- langchain-ai langgraph-apiLangGraph JavaScript custom authentication may permit cross-user Store access8.6 High
- red hat openshift ai (rhoai)Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization9.1 Critical
- rucioRucio: Authorisation Bypass on REST API endpoint for signing URLs8.1 High
- yosemitecrew yosemite-crewYosemiteCrew: Missing organization authorization on service and PMS library/template routes8.3 High
- acronis cyber protect 17Sensitive information disclosure due to improper authorization. The following products are...3.1 Low
- royal plugins mcp, unknown royal mcp +1 moreRoyal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page3.8 Low
- growi, inc. growiGROWI contains an authorization bypass vulnerability in its tag update API and the page update...2.3 Low
- growi, inc. growiGROWI contains an authorization bypass vulnerability in its page viewing and commenting...2.3 Low
- blair2004 nexoposNexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions5.3 Medium
- nopsolutions nopcommercenopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers5.3 Medium
- authlibAuthlib RFC 7592 examples omit registration-access-token client binding8.8 High
- netiket information technologies edowebIDOR in Netiket Information Technologies' EdoWEB4.3 Medium
- zmister2016 mrdocMrDoc through 1.1.1 Broken Access Control via manage_doc_share5.3 Medium
- anyant rssantrssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint6.9 Medium
- opnsense coreREDAXO before 5.21.4 Broken Access Control in Slice Operations7.1 High
- opnsense coreREDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move7.1 High
- openpanel-dev openpanelOpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences6.9 Medium
- kubernetesStatefulSet and ControllerRevision write permissions allow cross-namespace pod creation5.9 Medium
- qloappsQloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview6.9 Medium
- qloappsQloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation6.9 Medium
- hashicorp consul, consul enterprise +1 moreConsul vulnerable to an authorization bypass in health check registration6.4 Medium
- apache software foundation vysperApache Vysper: Authorization bypass8.8 High
- iflytek astron-agentiFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization5.3 Medium
- wproyal royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- ash-project ashAn upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records7.6 High
- No product listedHomestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated...7.1 High
- openremote coreOpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId2.3 Low
- openremote coreOpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos5.3 Medium
- openremote coreOpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket2.1 Low
- rcloneRclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads6.1 Medium
- thorsten phpmyfaqphpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID8.7 High
- dokployDokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router8.7 High
- unknown wpvrWP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR2.7 Low
- unknown wpvrWP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR3.8 Low
- onearmy community-platformONEARMY community-platform before 2.165.2 IDOR via notification read endpoint5.3 Medium
- xinnan-tech xiaozhi-esp32-serverXiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint5.3 Medium
- yunaiv yudao-cloudyudao-cloud through 2026.09 IDOR via after-sale-log list endpoint5.3 Medium
- Show moreLoading…