Browse / Insecure Direct Object Reference

Insecure Direct Object Reference

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Insecure Direct Object Reference (IDOR)373

Often found together with

• Access Control104
• Information Disclosure66
• Authentication43
• Misconfiguration30

Most upvoted Insecure Direct Object Reference reports

AllValidInformativeN/ADuplicate

1. IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit userInformativeInsecure Direct Object Reference (IDOR) · low · Reddit
   47 votes
2. BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence dataInformativeInsecure Direct Object Reference (IDOR) · medium · Nextcloud
   40 votes
3. IDOR able to buy a plan with lesser feeInformativeInsecure Direct Object Reference (IDOR) · medium · Automattic
   12 votes
4. Able to View other users income historyInformativeInsecure Direct Object Reference (IDOR) · Liberapay
   7 votes
5. Insecure Direct Object Reference on API without API keyInformativeInsecure Direct Object Reference (IDOR) · high · Semrush
   4 votes