HexBrain
Sign in

Browse / Insecure Direct Object Reference

Insecure Direct Object Reference

373disclosed reports
1weaknesses
$186,488paid in bounties

See it on the mapBypass libraryPayloads

Weaknesses in this class

Often found together with

Most upvoted Insecure Direct Object Reference reports

AllValidInformativeN/ADuplicate

  1. Delete anyone's content spotlight remotely.Insecure Direct Object Reference (IDOR) · high · Snapchat
    $15,000801 votes
  2. IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersInsecure Direct Object Reference (IDOR) · high · PayPal
    $10,500797 votes
  3. How the Bug stole hackingInsecure Direct Object Reference (IDOR) · HackerOne
    471 votes
  4. IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL queryInsecure Direct Object Reference (IDOR) · high · HackerOne
    395 votes
  5. IDOR allow access to payments data of any userInsecure Direct Object Reference (IDOR) · Nord Security
    387 votes
  6. IDOR allows user to access report details via reference.json endpointInsecure Direct Object Reference (IDOR) · critical · HackerOne
    $15,000372 votes
  7. Insecure Direct Object Reference (IDOR) - Delete Campaigns Insecure Direct Object Reference (IDOR) · high · HackerOne
    346 votes
  8. Attachment disclosure via summary report Insecure Direct Object Reference (IDOR) · critical · HackerOne
    340 votes
  9. Arbitrary Read of Another Users private repository without AuthorizationInsecure Direct Object Reference (IDOR) · high · GitHub
    $10,000276 votes
  10. Deleting all DMs on RedditGifts.comInsecure Direct Object Reference (IDOR) · high · Reddit
    $5,000267 votes
  11. Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json EndpointInsecure Direct Object Reference (IDOR) · critical · HackerOne
    266 votes
  12. idor allows you to delete photos and album from a galleryInsecure Direct Object Reference (IDOR) · Pornhub
    $1,500266 votes
  13. Singapore - Account Takeover via IDORInsecure Direct Object Reference (IDOR) · critical · Starbucks
    260 votes
  14. Steal private objects of other projects via project importInsecure Direct Object Reference (IDOR) · critical · GitLab
    $20,000254 votes
  15. IDOR allows any user to edit others videosInsecure Direct Object Reference (IDOR) · Pornhub
    $1,500248 votes
  16. IDOR: Account Deletion via Session Misbinding – Attacker Can Delete Victim AccountInsecure Direct Object Reference (IDOR) · high · Mozilla
    244 votes
  17. Insecure redirect rule results in bypassing ban redirect on certain pagesInsecure Direct Object Reference (IDOR) · medium · Roblox
    233 votes
  18. An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashierInsecure Direct Object Reference (IDOR) · high · Unikrn
    232 votes
  19. IDOR delete any Tickets on ads.tiktok.comInsecure Direct Object Reference (IDOR) · high · TikTok
    216 votes
  20. I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)Insecure Direct Object Reference (IDOR) · critical · Yelp
    214 votes
  21. IDOR vulnerability in unreleased HackerOne Copilot featureInsecure Direct Object Reference (IDOR) · medium · HackerOne
    210 votes
  22. IDOR allows an attacker to modify the links of any userInsecure Direct Object Reference (IDOR) · high · Reddit
    208 votes
  23. IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignalInsecure Direct Object Reference (IDOR) · critical · Automattic
    202 votes
  24. IDOR on GraphQL queries BillingDocumentDownload and BillDetailsInsecure Direct Object Reference (IDOR) · medium · Shopify
    $5,000187 votes
  25. read new emails from any inbox IOS APP in notification centerInsecure Direct Object Reference (IDOR) · Mail.ru
    $10,000186 votes
  26. IDOR Vulnerability at AddTagToAssets operation nameInsecure Direct Object Reference (IDOR) · medium · HackerOne
    178 votes
  27. IDOR leads to Edit Anyone's Blogs / WebsitesInsecure Direct Object Reference (IDOR) · high · Automattic
    177 votes
  28. Unauthorized Access to TikTok Account [Private Videos] via API EndpointInsecure Direct Object Reference (IDOR) · medium · TikTok
    167 votes
  29. Getting access of mod logs from any public or restricted subreddit with IDOR vulnerabilityInsecure Direct Object Reference (IDOR) · high · Reddit
    $5,000163 votes
  30. Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpointInsecure Direct Object Reference (IDOR) · low · HackerOne
    161 votes
  31. Disclose Hidden Comments on Media Section of hub.vroid.comInsecure Direct Object Reference (IDOR) · medium · pixiv
    $500149 votes
  32. Email change or personal data change on the account.Insecure Direct Object Reference (IDOR) · critical · Stripe
    $3,000149 votes
  33. Importing GitLab project archives can replace uploads of other usersInsecure Direct Object Reference (IDOR) · high · GitLab
    148 votes
  34. IDOR vulnerability (Price manipulation)Insecure Direct Object Reference (IDOR) · medium · Acronis
    146 votes
  35. Sale cancellations from other sellers without restrictionsInsecure Direct Object Reference (IDOR) · critical · MercadoLibre
    144 votes
  36. Missing ownership check on remote wipe endpointInsecure Direct Object Reference (IDOR) · high · Nextcloud
    $500141 votes
  37. IDOR and statistics leakage in Orders Insecure Direct Object Reference (IDOR) · medium · X / xAI
    $289141 votes
  38. IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage. Insecure Direct Object Reference (IDOR) · critical · MTN Group
    135 votes
  39. Private objects exposed through project importInsecure Direct Object Reference (IDOR) · critical · GitLab
    $20,000133 votes
  40. IDOR on ads.tiktok.com Allows Unauthorized Product AdditionInsecure Direct Object Reference (IDOR) · low · TikTok
    $500131 votes
  41. IDOR on in-app hardcoded zombie endpoint Insecure Direct Object Reference (IDOR) · medium · Bykea
    128 votes
  42. IDOR in https://3d.cs.money/Insecure Direct Object Reference (IDOR) · medium · CS Money
    127 votes
  43. IDOR to view order information of users and personal informationN/AInsecure Direct Object Reference (IDOR) · WakaTime
    126 votes
  44. [api.pandao.ru] IDOR for order delivery addressInsecure Direct Object Reference (IDOR) · Mail.ru
    $3,000125 votes
  45. IDOR for changing privacy settings on any memoriesInsecure Direct Object Reference (IDOR) · high · TikTok
    123 votes
  46. IDOR leads to leak analytics of any restaurantInsecure Direct Object Reference (IDOR) · medium · Uber
    123 votes
  47. PII Disclosure At `theperfumeshop.com/register/forOrder`Insecure Direct Object Reference (IDOR) · A.S. Watson Group
    118 votes
  48. IDOR Exposes All Machine Learning ModelsInsecure Direct Object Reference (IDOR) · medium · GitLab
    $1,160117 votes
  49. Unauthorized User can View Subscribers of Other Users NewslettersInsecure Direct Object Reference (IDOR) · high · LinkedIn
    117 votes
  50. Unauthorized access to resumes stored on LinkedInInsecure Direct Object Reference (IDOR) · high · LinkedIn
    112 votes
  51. IDOR leads to See analytics of Loyalty Program in any restaurant.Insecure Direct Object Reference (IDOR) · medium · Uber
    112 votes
  52. [IDOR] Improper Access Control on Embedded Submission FormInsecure Direct Object Reference (IDOR) · low · HackerOne
    $2,500110 votes
  53. IDOR on TikTok Ads EndpointInsecure Direct Object Reference (IDOR) · medium · TikTok
    109 votes
  54. Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modificationInsecure Direct Object Reference (IDOR) · medium · GitHub
    108 votes
  55. Broken Access Control (IDOR) in Booking Detail and Bids Could Leads to Sensitive Information DisclosureInsecure Direct Object Reference (IDOR) · high · Bykea
    108 votes
  56. Multiple IDORs in family pairing apiInsecure Direct Object Reference (IDOR) · high · TikTok
    107 votes
  57. User can pay using archived price by manipulating the request sent to `POST /v1/payment_pages/for_plink`Insecure Direct Object Reference (IDOR) · medium · Stripe
    100 votes
  58. IDOR vulnerability reveals additional informationInsecure Direct Object Reference (IDOR) · critical · Semrush
    99 votes
  59. IDOR allows an attacker to delete anyone's featured photo.Insecure Direct Object Reference (IDOR) · medium · LinkedIn
    99 votes
  60. █████████ when adding branches to your accountInsecure Direct Object Reference (IDOR) · critical · Mars
    98 votes
  61. An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.Insecure Direct Object Reference (IDOR) · high · LinkedIn
    94 votes
  62. IDOR when moving contents at CrowdSignalInsecure Direct Object Reference (IDOR) · high · Automattic
    94 votes
  63. Missing Access Control in MigrationFile allows attacker to upload files to any MigrationInsecure Direct Object Reference (IDOR) · high · GitHub
    92 votes
  64. IDOR - Leaking of team data (name, email, ID, member ID) via POST /api/v1/graphql `FetchMemberships` operationInsecure Direct Object Reference (IDOR) · medium · Tools for Humanity
    $50091 votes
  65. Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne usersInsecure Direct Object Reference (IDOR) · high · HackerOne
    91 votes
  66. [unibet.com] Delete messages via IDOR at /mom-api/messages/unibet_█████████@unibet/Insecure Direct Object Reference (IDOR) · Kindred Group
    89 votes
  67. Private circle can be added to another circle via API despite visibility restrictionInsecure Direct Object Reference (IDOR) · low · Nextcloud
    $15087 votes
  68. IDOR to make someone attend or leave an eventInsecure Direct Object Reference (IDOR) · medium · LinkedIn
    87 votes
  69. IDOR to view order information of users and personal informationInsecure Direct Object Reference (IDOR) · medium · Affirm
    $50087 votes
  70. IDOR vulnerability leads to Deleting message after leaving/getting banned from group using message IDInsecure Direct Object Reference (IDOR) · low · Rocket.Chat
    86 votes
  71. Access User Tickets via IDOR in [widget.support.my.games]Insecure Direct Object Reference (IDOR) · Mail.ru
    86 votes
  72. WebAuthn app was updated based on public keyInsecure Direct Object Reference (IDOR) · low · Nextcloud
    84 votes
  73. IDOR on Delete Email address featuresInsecure Direct Object Reference (IDOR) · high · Mozilla
    84 votes
  74. Attackers can use TRIAL Premium only by paying **IDR 10,000.00** from the original price of `IDR462,400.00` per monthInsecure Direct Object Reference (IDOR) · high · LinkedIn
    84 votes
  75. Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platformInsecure Direct Object Reference (IDOR) · high · TikTok
    84 votes
  76. Unauthorized Access to Private Video Description via Translation API for Private AccountsInsecure Direct Object Reference (IDOR) · low · TikTok
    82 votes
  77. Insecure Direct Object Reference (IDOR) in GraphQL deleteProfileImages MutationInsecure Direct Object Reference (IDOR) · high · Autodesk
    80 votes
  78. Improper Access Control Allows Trip Hijacking and Passenger/Driver PII DisclosureInsecure Direct Object Reference (IDOR) · medium · Bykea
    80 votes
  79. Unauthorized Reservation Cancellation Through IDOR VulnerabilityDuplicateInsecure Direct Object Reference (IDOR) · high · Yelp
    79 votes
  80. IDOR on HackerOne Feedback ReviewInsecure Direct Object Reference (IDOR) · low · HackerOne
    79 votes
  81. Access to Deactivated LinkedIn Company Pages via Competitor Analytics APIInsecure Direct Object Reference (IDOR) · medium · LinkedIn
    77 votes
  82. IDOR leading unauthenticated attacker to download documents discloses PII of users and soldiers via https://www.█████████/Download.aspx?id= [HtUS]Insecure Direct Object Reference (IDOR) · high · U.S. Dept Of Defense
    $50077 votes
  83. IDOR via internal_api "users" endpoint Insecure Direct Object Reference (IDOR) · New Relic
    $1,50077 votes
  84. Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosureInsecure Direct Object Reference (IDOR) · low · Basecamp
    $10076 votes
  85. Ability to increase any customer offered fare (BAC)Insecure Direct Object Reference (IDOR) · medium · Bykea
    76 votes
  86. Reporter, external users, collaborators can mark sent swag awarded to reporter as unsentInsecure Direct Object Reference (IDOR) · medium · HackerOne
    76 votes
  87. Autotranslate DDP Method Exposes Private Messages Without Authentication or Room Access CheckInsecure Direct Object Reference (IDOR) · high · Rocket.Chat
    74 votes
  88. IDOR allows information disclosureInsecure Direct Object Reference (IDOR) · high · Semrush
    74 votes
  89. IDOR the ability to view support tickets of any user on seller platformInsecure Direct Object Reference (IDOR) · medium · TikTok
    $2,50074 votes
  90. TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk BotInsecure Direct Object Reference (IDOR) · medium · Nextcloud
    73 votes
  91. Insecure Direct Object Reference (IDOR) Vulnerability in Autodesk User ProfileInsecure Direct Object Reference (IDOR) · medium · Autodesk
    73 votes
  92. Arbitrary thread deletion on c.realme.comInsecure Direct Object Reference (IDOR) · OPPO
    $60073 votes
  93. **Unauthenticated IDOR allows modification of payment customer billing information**Insecure Direct Object Reference (IDOR) · high · Weblate
    72 votes
  94. Reddit talk promotion offers don't expire, allowing users to accept them after being demotedInsecure Direct Object Reference (IDOR) · medium · Reddit
    72 votes
  95. A staff member with no permissions can edit Store Customer EmailInsecure Direct Object Reference (IDOR) · medium · Shopify
    $1,50072 votes
  96. Add labels to arbitrary issues/prs & compromise github actions label checksInsecure Direct Object Reference (IDOR) · medium · GitHub
    71 votes
  97. IDOR vulnerability on profile picture changing mechanism which discloses other user's profile picture.Insecure Direct Object Reference (IDOR) · Glassdoor
    71 votes
  98. IDOR Vulnerability Allowing Unauthorized Profile Picture ChangeInsecure Direct Object Reference (IDOR) · medium · Autodesk
    69 votes
  99. Authentication Bypass in Subscription Management EndpointInsecure Direct Object Reference (IDOR) · critical · lemlist
    68 votes
  100. Account takeover through password reset in cups.mail.ruInsecure Direct Object Reference (IDOR) · Mail.ru
    68 votes