CWE-639: Insecure Direct Object Reference / IDOR
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Also known as Authorization Bypass Through User-Controlled Key, Broken Object Level Authorization / BOLA, Horizontal Authorization.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connectMultiple Vulnerabilities in IBM API Connect8.5 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.1 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.1 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect6.5 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect6.4 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.6 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect5.0 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.9 Critical
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.7 High
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints6.5 Medium
- techjewel fluent support – helpdesk & customer support ticket systemFluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed3.7 Low
- microsoft entra device registrationEntra Device Registration Elevation of Privilege Vulnerability10.0 Critical
- ignisda ryotRyot: Cross-tenant collection read via `collectionContents`4.3 Medium
- ignisda ryotRyot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)5.9 Medium
- chartbrewChartbrew: Cross-tenant project takeover via body.team_id in /project routes8.8 High
- bubka 2fauth2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration6.5 Medium
- faveosuite faveo-helpdeskFaveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print5.3 Medium
- open-wanderer wandererWanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints7.5 High
- freescout-help-desk freescoutFreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key6.5 Medium
- freescout-help-desk freescoutFreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (`#`) shortcut (missing mailbox authorization)4.3 Medium
- freescout-help-desk freescoutFreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query7.7 High
- jetbrains dataloreIn JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using...7.5 High
- 201206030 novelxxyopen/201206030 novel Book Chapter Read BookServiceImpl.java getBookChapter authorization5.3 Medium
- posit software, pbc workbench, rstudio server +1 moreRStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership4.7 Medium
- zhimaai chatwikiChatWiki before 2.10.0 Cross-Tenant IDOR via SaveFormField and UpdateFormRequired5.3 Medium
- zhimaai chatwikiChatWiki before 2.10.0 Cross-Tenant Fast Command Modification via saveFastCommand5.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed...5.4 Medium
- jetbrains dataloreIn JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's...4.3 Medium
- mdjm event management, unknown mdjm event management, mobile events manager +2 moreMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOR8.8 High
- kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changesPublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR2.7 Low
- undiciundici vulnerable to cross-user cache disclosure via same-origin redirect6.5 Medium
- kubeflow pipelinesKubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)5.4 Medium
- kubeflow pipelinesKubeflow Pipelines API server lacks authorization for shared pipeline uploads9.6 Critical
- tpc software matchpointInsecure direct object reference (IDOR) vulnerability in the MatchPoint API9.9 Critical
- open-emr openemrOpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment9.6 Critical
- suitecrmSuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack7.1 High
- suitecrmSuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php6.5 Medium
- suitecrmSuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration6.5 Medium
- suitecrmSuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage6.5 Medium
- balbooa.com gridbox extension for joomlaJoomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.06.9 Medium
- immich-app immichImmich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints8.8 High
- immich-app immichImmich calendar heatmap endpoint discloses cross-user activity through broken access control4.3 Medium
- keywordrush content egg – affiliate product importer & price comparisonContent Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks6.9 Medium
- chevere spa cheveretoChevereto before 4.5.8 Private Album Image Disclosure via get-album-contents6.9 Medium
- Show moreLoading…