CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- fossasia eventyay-exhibitioneventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API2.3 Low
- oss-apps splitproSplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails2.3 Low
- oss-apps splitproSplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query5.3 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification5.4 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association5.4 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification6.5 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure6.5 Medium
- g5theme essential real estateEssential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR4.3 Medium
- unknown wp event manager, wp event manager event manager +1 moreWP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR8.2 High
- unknown wp event manager, wp event manager event manager +1 moreWP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids8.1 High
- kyvernoKyverno before 1.19.2 Label Spoofing via Generation Handler processRequest8.4 High
- shenzhen shine industrial co., ltd. vitafitVitaFit Cloud API IDOR via profile_id Endpoints6.9 Medium
- readestReadest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller6.5 Medium
- 6amtech 6valley6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization6.9 Medium
- gpustackGPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover8.8 High
- cisco telepresenceTelepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable8.2 High
- invoiceninjaInvoice Ninja < 5.13.28 Broken Access Control via Vendor Portal7.1 High
- ayecode ltd payment forms, buy now buttons, and invoicing system | getpaidGetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice6.9 Medium
- warp-tech warpgateWarpgate: Kubernetes authorization correlation can be reused by a recreated same-name account6.8 Medium
- oqtane oqtane.frameworkOqtane Framework before 10.3.0 Broken Access Control via SettingController7.4 High
- coopcycle coopcycle-webCoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint7.2 High
- stonewuu ai-fusion-videoStonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers8.7 High
- moyangzhan langchain4j-aideepinlangchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}6.0 Medium
- blackholll loonflowloonflow before r3.2.3 IDOR via ticket_flow_history Endpoint2.3 Low
- about time technologies herowatch go serverAbout Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference8.7 High
- shahjada premium packagesPremium Packages < 7.3.1 - Subscriber+ Guest Order Takeover5.4 Medium
- shahjada premium packagesPremium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure3.7 Low
- g5theme essential real estateEssential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR6.5 Medium
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR3.8 Low
- infiniflow ragflowInfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization5.3 Medium
- sanluan publiccmsSanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization5.3 Medium
- No product listedUmami Record API Endpoint route.ts authorization6.9 Medium
- zane-opsZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView6.0 Medium
- francoisjacquet rosariosisRosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment2.1 Low
- tanium discoverTanium addressed an improper access controls vulnerability in Discover.6.5 Medium
- lightdashLightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints2.3 Low
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure4.3 Medium
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure4.3 Medium
- team-alembic ash authenticationAshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account7.6 High
- logchimpLogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts7.1 High
- ricky-7-yan intelligent-audit-systemAuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id2.3 Low
- beecue fastbeeFastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints8.7 High
- frappe hrmsFrappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API5.3 Medium
- am system alo suiteDirect Object Reference (IDOR) vulnerability in Alosuite6.9 Medium
- typo3 extension "mail"Information Disclosure in extension "Mail" (mail)6.9 Medium
- typo3 extension "frontend user registration"Broken Access Control in extension "Frontend User Registration" (sf_register)8.8 High
- petpooja munshiMunshi IDOR via Purchase Inquiry Thread Endpoint7.1 High
- petpooja munshiMunshi Broken Object Level Authorization via Invoice Deletion API7.1 High
- dj-extensions.com dj-classifieds extension for joomlaJoomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.35.3 Medium
- nlnet labs krillKrill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server8.4 High
- Show moreLoading…