Description
IDOR occurs when an application provides direct access to objects based on user input without proper authorization checks. This vulnerability allows attackers to manipulate object identifiers to access sensitive information or perform unauthorized operations. For example, changing a user ID in a URL parameter might grant access to another user’s account details.
Recommendation
To mitigate IDOR vulnerabilities, implement access control mechanisms that validate user permissions before granting access to resources. Use indirect references (e.g., tokens) instead of exposing direct object references in URLs or other inputs. Ensure that sensitive endpoints enforce proper authorization policies.
References
- OWASP: Insecure Direct Object Reference (IDOR)
- OWASP Top Ten 2021 - Broken Access Control
- CWE-639
- CAPEC-180
- OWASP 2021-A1
Related Issues
- @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) - CVE-2024-22206
- Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing - CVE-2026-1664
- Apache Tomcat Manager Login Found - Vulnerability
- Missing or Insecure Cache-Control Header - Vulnerability
You might also like:
- Tags:
- IDOR
- Authorization
- Access Control
Anything's wrong? Let us know Last updated on February 15, 2025