CWE-639 · Insecure Direct Object Reference
Insecure Direct Object Reference
3,399CVEs
1exploited
22with a public check
7likely (EPSS 10%+)
SortMost likely exploited
3,399 CVEs with CWE-639 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-55255In CISA KEVExploitedLangflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flowlangflow-ai · langflow · CVSS 8.4 · 2026-06-23 | 8.4 | 0.9% | 2026-06-23 |
| CVE-2023-6875CheckWordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypasssaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Al… · CVSS 9.8 · 2024-01-11 | 9.8 | 90% | 2024-01-11 |
| CVE-2021-45428CheckTelesquare TLR-2005KSH 1.0.0 - Arbitrary File UploadTelesquare · Tlr-2005ksh Firmware · 2022-01-03 | – | 57% | 2022-01-03 |
| CVE-2019-17382CheckZabbix <=4.4 - Authentication BypassZabbix · Zabbix · 2019-10-09 | – | 53% | 2019-10-09 |
| CVE-2025-2563CheckUser Registration & Membership <= 4.1.1 - Unauthenticated Privilege EscalationWpeverest · User Registration & Membership · CVSS 8.1 · 2025-04-14 | 8.1 | 49% | 2025-04-14 |
| CVE-2020-13700CheckWordPress acf-to-rest-api <=3.1.0 - Insecure Direct Object ReferenceAcf To Rest Api Project · Acf To Rest Api · 2020-06-24 | – | 13% | 2020-06-24 |
| CVE-2019-17574CheckPopup-Maker < 1.8.12 - Broken AuthenticationCode-Atlantic · Popup Maker · 2019-10-14 | – | 9.4% | 2019-10-14 |
| CVE-2025-3605CheckWordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalationarkenon · Login, Registration and Lost Password Blocks · CVSS 9.8 · 2025-05-09 | 9.8 | 7.8% | 2025-05-09 |
| CVE-2023-3219CheckEventON Lite < 2.1.2 - Arbitrary File DownloadMyeventon · EventON · 2023-07-10 | – | 7.5% | 2023-07-10 |
| CVE-2025-5947CheckService Finder Bookings - Authentication Bypassaonetheme · Service Finder Bookings · CVSS 9.8 · 2025-08-01 | 9.8 | 4.9% | 2025-08-01 |
| CVE-2026-18315CheckTrueBooker <= 1.2.6 - Unauthenticated Authorization Bypassthemetechmount · TrueBooker – Appointment Booking and Scheduler System · CVSS 9.8 · 2026-08-19 | 9.8 | 3.0% | 2026-08-19 |
| CVE-2022-2034CheckWordPress Sensei LMS <4.5.0 - Information DisclosureAutomattic · Sensei LMS · 2022-08-29 | – | 2.7% | 2022-08-29 |
| CVE-2022-2535CheckSearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title DisclosureSearchwp · SearchWP Live Ajax Search · 2022-08-15 | – | 2.1% | 2022-08-15 |
| CVE-2025-14998CheckBranda WordPress plugin - Privilege Escalationwpmudev · Branda – White Label & Branding, Free Login Page Customizer · CVSS 9.8 · 2026-01-02 | 9.8 | 1.9% | 2026-01-02 |
| CVE-2025-4210CheckCasdoor - Authorization BypassCasdoor · CVSS 7.3 · 2025-05-02 | 7.3 | 1.8% | 2025-05-02 |
| CVE-2024-9617CheckDanswer - Insecure Direct Object Referencedanswer-ai · danswer-ai/danswer · CVSS 6.5 · 2025-03-20 | 6.5 | 1.7% | 2025-03-20 |
| CVE-2022-3805CheckJeg Elementor Kit < 2.5.7 - Unauthenticated Settings Updatejegtheme · Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for… · CVSS 8.6 · 2022-12-22 | 8.6 | 1.7% | 2022-12-22 |
| CVE-2026-89063CheckBookly <=28.1 - IDOR Unauthenticated Sensitive Data Accessladela · Online Scheduling and Appointment Booking System – Bookly · CVSS 7.5 · 2026-09-16 | 7.5 | 1.6% | 2026-09-16 |
| CVE-2022-1580CheckSite Offline WP Plugin < 1.5.3 - Authorization BypassFreehtmldesigns · Site Offline Or Coming Soon Or Maintenance Mode · 2022-09-19 | – | 1.6% | 2022-09-19 |
| CVE-2026-8679CheckWordPress AudioIgniter <= 2.0.2 - Unauthenticated IDORcssigniterteam · AudioIgniter Music Player · CVSS 7.5 · 2026-05-22 | 7.5 | 1.6% | 2026-05-22 |
| CVE-2024-5333CheckWordPress Events Calendar 6.8.2.1 - Information DisclosureStellarwp · The Events Calendar · CVSS 5.3 · 2024-12-16 | 5.3 | 1.1% | 2024-12-16 |
| CVE-2026-8839CheckWordPress MapPress Maps <= 2.96.6 - Unauthenticated IDORchrisvrichardson · MapPress Maps for WordPress · CVSS 5.3 · 2026-06-06 | 5.3 | 1.0% | 2026-06-06 |
| CVE-2026-40308CheckMy Calendar WordPress Plugin - Information Disclosurejoedolson · my-calendar · CVSS 8.8 · 2026-04-16 | 8.8 | 0.9% | 2026-04-16 |
| CVE-2024-46982Cache Poisoning in next.jsvercel · next.js · CVSS 7.5 · 2024-09-17 | 7.5 | 59% | 2024-09-17 |
| CVE-2019-13360In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.Control-Webpanel · Webpanel · 2019-07-16 | – | 24% | 2019-07-16 |
| CVE-2023-48783An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, versi…Fortinet · FortiPortal · CVSS 4.9 · 2024-01-10 | 4.9 | 22% | 2024-01-10 |
| CVE-2021-26024The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account.Nagios · Favorites · 2021-02-03 | – | 19% | 2021-02-03 |
| CVE-2024-0264SourceCodester Clinic Queuing System LoginRegistration.php authorizationSourceCodester · Clinic Queuing System · CVSS 7.3 · 2024-01-07 | 7.3 | 18% | 2024-01-07 |
| CVE-2019-13605In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid us…Control-Webpanel · Webpanel · 2019-07-16 | – | 15% | 2019-07-16 |
| CVE-2022-22832An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request.Servisnet · Tessa · 2022-02-06 | – | 14% | 2022-02-06 |
| CVE-2021-40352OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.Open-Emr · Openemr · 2021-09-01 | – | 9.7% | 2021-09-01 |
| CVE-2019-6716An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Ac…Logonbox · Nervepoint Access Manager · 2019-03-17 | – | 9.6% | 2019-03-17 |
| CVE-2025-2594User Registration & Membership < 4.1.3 - Authentication BypassWpeverest · User Registration & Membership · CVSS 8.1 · 2025-04-22 | 8.1 | 9.5% | 2025-04-22 |
| CVE-2019-25487SAPIDO RB-1732 V2.0.43 Remote Command Execution via formSysCmdSapido · RB-1732 · CVSS 9.8 · 2026-03-11 | 9.8 | 9.0% | 2026-03-11 |
| CVE-2019-12252In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Sol…Zohocorp · Manageengine Servicedesk Plus · 2019-05-21 | – | 8.2% | 2019-05-21 |
| CVE-2022-40319The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL. The impact is unaut…Lsoft · Listserv · CVSS 7.5 · 2023-01-17 | 7.5 | 7.4% | 2023-01-17 |
| CVE-2026-7665Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handlerwpdevteam · Essential Addons for Elementor – Popular Elementor Templates & Widgets · CVSS 5.3 · 2026-06-06 | 5.3 | 6.8% | 2026-06-06 |
| CVE-2026-33484Langflow has Unauthenticated IDOR on Image Downloadslangflow-ai · langflow · CVSS 7.5 · 2026-03-24 | 7.5 | 6.1% | 2026-03-24 |
| CVE-2026-41947Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpointslanggenius · dify · CVSS 9.1 · 2026-05-18 | 9.1 | 6.0% | 2026-05-18 |
| CVE-2018-16606In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted papers (Title and Abstract) and their authors' personal informat…Proconf · Proconf · 2018-09-06 | – | 5.9% | 2018-09-06 |
| CVE-2014-8356The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related…Dasanzhone · Znid 2426a Firmware · 2019-11-21 | – | 5.6% | 2019-11-21 |
| CVE-2021-3965Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews.Hp · HP DesignJet Printer · 2022-01-14 | – | 5.4% | 2022-01-14 |
| CVE-2020-13923IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04Apache · Apache OFBiz · 2020-07-15 | – | 5.0% | 2020-07-15 |
| CVE-2019-14724In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victim's account via an…Control-Webpanel · Webpanel · 2019-09-11 | – | 4.4% | 2019-09-11 |
| CVE-2021-46416Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.Sma · Sunny Tripower Firmware · CVSS 5.4 · 2022-04-07 | 5.4 | 4.3% | 2022-04-07 |
| CVE-2022-31692Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an ap…Vmware · Spring by VMware · CVSS 9.8 · 2022-10-31 | 9.8 | 4.2% | 2022-10-31 |
| CVE-2020-29156The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action.Woocommerce · Woocommerce · 2020-12-27 | – | 4.0% | 2020-12-27 |
| CVE-2021-21012Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information DisclosureAdobe · Magento Commerce · CVSS 5.3 · 2021-01-13 | 5.3 | 3.9% | 2021-01-13 |
| CVE-2024-12483Dromara UJCMS User ID id authorizationDromara · UJCMS · CVSS 3.7 · 2024-12-11 | 3.7 | 3.6% | 2024-12-11 |
| CVE-2020-15958An issue was discovered in 1CRM System through 8.6.7. An insecure direct object reference to internally stored files allows a remote attacker to access various sensitive informati…1crm · 1crm · 2020-09-18 | – | 3.2% | 2020-09-18 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.