connection · two weakness classes
Access Control with Insecure Direct Object Reference
179 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy: this is what the line between them on the dial stands for.
- check available
- 1
Every one of the 179 is a mark on the map. Named now: 1 to 26, most at risk first.
- Discourse - Private Group Membership Inference via exclude_groups
- Langflow has Unauthenticated IDOR on Image Downloads
- TOTOLINK LR350 formLoginAuth.htm authorization
- DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $_GET['file'] is filename,and as there is no filter function for security, you can read any fil…
- SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints
- Click Studios Passwordstate API authorization
- Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*
- Indico vulnerable to user enumeration via API endpoint
- GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
- Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
- A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwo…
- Apache Allura: Missing permission checks IDOR
- Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
- Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking
- Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info
- WeGIA: Authorization Bypass via Empty Resource Array in InternoControle
- Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any…
- Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host
- Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
- Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models
- IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
- Leantime JSON-RPC API contains a missing authorization vulnerability
- Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
- Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).
- HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
- Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.