CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- nlnet labs krillKrill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import8.4 High
- dromara jpomJpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch8.7 High
- dromara jpomJpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers8.7 High
- owen2345 camaleon cmsCamaleon CMS before 2.9.2 IDOR via Admin::CategoriesController5.3 Medium
- zmister2016 mrdocMrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read5.3 Medium
- opencsg csghubOpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route8.7 High
- munafio chatifyChatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint7.1 High
- apache software foundation syncopeApache Syncope: Delegated administration boundaries can be bypassed for Realm update9.1 Critical
- sanluan publiccmsSanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization5.3 Medium
- giteaGitea OAuth2 account auto-linking takeover through the sign-up form9.8 Critical
- gnmyt nextermNexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes5.3 Medium
- learnhouseLearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API5.3 Medium
- roostorg coopCoop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser5.3 Medium
- inex ixp-managerIXP Manager has Broken Object-Level Authorization8.3 High
- hargata lubelogLubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration6.5 Medium
- shopperdotcom shopperShopper: customer detail IDOR exposes administrator and staff records6.5 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username8.9 High
- immich-app immichImmich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers4.3 Medium
- nodebbNodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid6.9 Medium
- yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 moreWordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability5.3 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter7.5 High
- infonl dimpact-zaakafhandelcomponentZAC: Missing per-zaaktype authorization on by-ID decision and process reads6.5 Medium
- colinin abp-next-adminabp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name7.1 High
- socfortress copilotSOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)8.5 High
- wannabespace tameryTamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update5.3 Medium
- wannabespace tameryTamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create5.3 Medium
- star7th showdocShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries2.3 Low
- blossom-editor blossomBlossom through 1.17.1 Authorization Bypass via Folder Endpoints5.3 Medium
- powerdns-adminPowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update5.3 Medium
- zyx0814 filepressFilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations2.3 Low
- hulaspark hula-serverHuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure5.3 Medium
- hulaspark hula-serverHuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion5.3 Medium
- hulaspark hula-serverHuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController5.3 Medium
- dromara ruoyi-vue-plusRuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}5.3 Medium
- open web analytics web analytics, openwebanalytics open web analytics +1 moreOpen Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API5.3 Medium
- easysoft zentaopmsZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc7.1 High
- blossom-editor blossomBlossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints5.3 Medium
- iluobei miaomiaowuMiaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id5.3 Medium
- hdinnovations unit3dUNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download5.3 Medium
- parse-community parse-serverParse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID6.3 Medium
- No product listedBusiness::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate6.1 Medium
- moodleMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback5.3 Medium
- getlago lagoLago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook2.3 Low
- forgejoForgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}5.3 Medium
- juspay hyperswitchHyperswitch through 1.128.0 Missing Authorization in Payout Confirmation8.2 High
- cloud foundry capi (cloud foundry controller), cf deployment +1 moreSpace Developer can extract space-scoped broker credentials2.7 Low
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: authorization bypass via uma resource registration idor4.3 Medium
- No product listedSkuul School Management System through version 2.6.5 is vulnerable to incorrect access control in...6.5 Medium
- labredescefetrj wegiaWeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes8.1 High
- bricks themeBricks Theme Broken Access Control via load_popup_content7.5 High
- Show moreLoading…