Weakness class · IDOR
Insecure Direct Object Reference
3,409 published CVEs name a weakness in this class; 1 of them are exploited in the wild.
CWEs in this class2
| CWE | Weakness | CVEs | Exploited | Check |
|---|---|---|---|---|
| CWE-639 | Insecure Direct Object Reference | 3,399 | 1 | 22 |
| CWE-566 | Authorization Bypass Through User-Controlled SQL Primary Key | 10 | 0 | 0 |
Exploited and check counts are given for the class's largest CWEs; open a CWE for its CVEs.
Data as of 2026-11-14.