Insecure Direct Object Reference (IDOR)
Insecure Direct Object Reference (IDOR) is a vulnerability that arises when attackers can access or modify objects by manipulating identifiers used in a web application's URLs or parameters. It occurs due to missing access control checks, which fail to verify whether a user should be allowed to access specific data.
IDOR vulnerabilities are among the most common and impactful bugs found in bug bounty programs. They typically appear in API endpoints that reference database objects by predictable IDs — user profiles, invoices, messages, or files. An attacker simply changes an ID parameter (e.g., /api/users/1234 to /api/users/1235) to access another user's data. The impact ranges from information disclosure to full account takeover, depending on the affected endpoint.
Common patterns include sequential integer IDs in REST APIs, UUID leakage through other endpoints, and GraphQL queries that expose object references without authorization checks. Prevention requires server-side access control on every request — never relying on obscurity of identifiers alone.
This page collects writeups, tutorials, and tools for finding and exploiting IDOR vulnerabilities, from basic parameter tampering to advanced techniques like BOLA (Broken Object Level Authorization) in modern APIs.
From OWASP
Why IDOR outlives every framework that was supposed to kill it
IDOR is the least sophisticated bug on this site and one of the most frequently paid. There is no payload, no encoding trick, no parser edge case. You change a number in a request and the application hands you somebody else's data. The reason it persists is that nothing in a web framework stops it. Frameworks solved SQL injection with parameterized queries and XSS with automatic output encoding, because both are syntax problems the framework can see. Authorization is a business question — whether this user should see this record — and the framework has no idea what the answer is.
That is also why IDOR resists scanners. A scanner can tell that
/api/invoice/1041 returned 200, but not that invoice 1041 belongs
to a different tenant. Finding these bugs means holding two authenticated
sessions at once and replaying one account's requests with the other's
credentials. Most of the substantial writeups collected here are built on
exactly that setup, and the interesting part is rarely the discovery — it is
working out which identifiers in a large API actually map to sensitive objects.
The failure modes worth knowing: sequential integers are the obvious case, but UUIDs only help if they are unguessable and still checked, and plenty of applications treat an opaque identifier as authorization in itself. Look for IDs echoed in export jobs, webhook payloads, PDF generators and notification emails, where the object is fetched by a background worker that never sees the requesting user. Look at second-order flows: an endpoint that correctly rejects a foreign ID on read may accept it on update, or on the "duplicate this record" action nobody thought of as a read.
Mass assignment sits next door and is often mistaken for IDOR. If you can
add "role":"admin" or "account_id":7 to a JSON body
and the ORM binds it, the object reference was never the problem. Several
entries below cover both, and it is worth reading them together — they fail
for the same underlying reason, which is that the server trusted the shape of
the request.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-10-21 2026 | How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs beginner XSS | This article provides insights from top security researchers on how to identify Insecure Direct Object Reference (IDOR), Stored Cross-Site Scripting (XSS), and Information Disclosure vulnerabilities. It details the methodologies and techniques used by these experts to discover these common and impactful security flaws. The content aims to educate readers on the practical approaches for finding these specific Common Weakness Enumerations (CWEs). → yeswehack.com |
| 2026-09-09 2026 | BOLA: Enumerating an Entire Employee Directory Through a Predictable ID intermediate AuthZ | During a penetration test of a corporate SaaS platform, a cybersecurity engineer discovered a vulnerability allowing enumeration of an entire employee directory through a predictable ID. This "Broken Object Level Authorization" (BOLA) vulnerability on an HR endpoint enabled access to sensitive employee information. The issue was reported to the client and has since been remediated. → infosecwriteups.com |
| 2026-09-06 2026 | ExploitSpec — BOLA/IDOR regression tests from bounded, redacted HAR input intermediate 1 min read API Sec AuthZ | Library for creating regression tests from existing HTTP exploits, specifically designed for BOLA/IDOR vulnerabilities. ExploitSpec allows security invariants to be kept alongside application code, enabling local and CI-based re-runs. It supports isolating actor headers, cookies, and sessions, capturing dynamic values for later use, and emitting results in readable text, JSON, or JUnit formats. The tool helps ensure that confirmed vulnerabilities do not reappear by proving RED, GREEN, and STABLE states before build failure. |
| 2026-09-04 2026 | [$538] IDOR allows friends to edit the date on their friends’ timeline posts on Facebook beginner | A critical IDOR vulnerability on Facebook allowed users to edit the creation date of timeline posts made by their friends. Normally, users cannot alter dates on posts created by others. This flaw compromises the authenticity of timeline content. The reporter received a bounty of $538 for identifying this issue. → infosecwriteups.com |
| 2026-08-26 2026 | State divergence enables unauthorized access intermediate 5 min read AuthZ | Analysis of Provenance Blockchain reveals a critical vulnerability where state divergence allowed any user to grant themselves admin control over marker accounts. Versions before 1.28.0 were affected, impacting 82 markers representing live financial assets. The bug stemmed from an authorization check for minting and escrow withdrawal, which incorrectly evaluated against a stale supply field for non-fixed markers. Exploitation required two transactions: one to gain unauthorized ACCESS_ADMIN, and another to mint new tokens or drain escrowed assets. The issue was mitigated in v1.28.0 and fully fixed in v1.29.0. → blog.trailofbits.com |
| 2026-08-17 2026 | Introducing Session Switcher. Swap Burp Sessions with One Click! intermediate 4 min read AuthZ Burp | Library for managing Burp Suite HTTP sessions, Session Switcher streamlines authorization testing by allowing users to save and switch between multiple named sessions with a single click directly from the request editor. It automates the tedious process of copying and pasting cookies and headers, reducing errors and improving focus during privilege escalation and IDOR testing. The extension can also auto-update saved sessions by monitoring proxy traffic, ensuring authentication data remains valid throughout an engagement. → blog.doyensec.com |
| 2026-08-13 2026 | ERPNext's Document Follow feature exposed unauthorized data news 5 min read AuthZ | Writeup detailing a vulnerability chain in Frappe's Document Follow feature, affecting ERPNext. The exploit involves three authorization failures: object-level access, field-level data leakage, and persistence of email notifications after permission revocation. These issues, designated CVE-2026-66000, CVE-2026-66058, and CVE-2026-66059, allowed unauthorized users to follow any document and receive updates containing sensitive information. |
| 2026-07-30 2026 | Account Takeover Across Multiple Programs via Featurebase Integration intermediate 2 min read AuthZ Bug Bounty | Writeup detailing an IDOR vulnerability in the Featurebase feedback platform, leading to account takeover (ATO). The issue stems from Featurebase trusting client-controlled identity attributes without validation, allowing attackers to impersonate other users by modifying `userId` in API requests or changing user profiles and obtaining access tokens. The author notes Featurebase's stance that this is a website owner's responsibility to fix, but suggests JWT for securing installations. → infosecwriteups.com |
| 2026-07-29 2026 | Unprotected admin functionality — PortSwigger Access control vulnerabilities Lab 1 beginner 2 min read AuthZ Bug Bounty | Writeup detailing the exploitation of Broken Access Control (BAC-Portswigger-001) in a PortSwigger lab, where an unprotected administrator panel was discoverable via the `robots.txt` file. An unauthenticated attacker can access the `/administrator-panel` endpoint, allowing sensitive actions like deleting user accounts, leading to full application compromise. Remediation involves enforcing authentication, implementing authorization checks, and avoiding reliance on `robots.txt` for security. → infosecwriteups.com |
| 2026-07-29 2026 | How I found an IDOR in Google Classroom on Day 3 of my Hunting? beginner 3 min read API Sec Bug Bounty | Writeup detailing an Insecure Direct Object Reference (IDOR) vulnerability discovered in Google Classroom. The vulnerability stemmed from the `batchexecute` system, an undocumented internal RPC protocol. By manipulating `submission ID` parameters within POST requests to the `batchexecute` endpoint, an attacker could post private comments to any student's assignment submission, bypassing intended authorization controls and making the comment visible to the student and teacher. The writeup also explains how submission IDs were discoverable through traffic analysis. → infosecwriteups.com |
| 2026-07-18 2026 | The $0 IDOR That Was Worth More Than a $12,500 P1 intermediate 1 min read Bug Bounty | Writeup analyzing Insecure Direct Object Reference (IDOR) vulnerabilities, contrasting a GraphQL alias abuse bug that garnered a $12,500 bounty with an IDOR exposing all user data for over three years that received $0. The analysis highlights how true impact, beyond proof-of-concept screenshots, dictates bug bounty payouts, noting the latter IDOR was triaged as "Informative" and remained exploitable for years. → infosecwriteups.com |
| 2026-07-18 2026 | How I Found a Cross-Student IDOR in Academy LMS That Leaked Correct Quiz Answers intermediate 8 min read AuthZ | Writeup of a Cross-Student IDOR vulnerability in Academy LMS plugin, affecting over 2,000 installations. The vulnerability, discovered by analyzing the plugin's API controllers, allowed any enrolled student to view another student's quiz results and obtain correct answers. This was achieved by exploiting two authorization failures in the `get_student_quiz_attempt_details` endpoint, which incorrectly processed the `user_id` parameter from requests and evaluated access permissions against the target user's context rather than the caller's. → infosecwriteups.com |
| 2026-07-07 2026 | Predicting MongoDB ObjectId() continuously in Rocket.Chat advanced 12 min read | Writeup detailing a vulnerability in Rocket.Chat, #3687142, where unauthenticated users can access any uploaded file by predicting its MongoDB ObjectId(). The article explains how the ObjectId() is composed of a timestamp, machine/process ID, and a counter, allowing attackers to enumerate valid file IDs and bypass authorization checks through the Livechat functionality. → aikido.dev |
| 2026-06-20 2026 | Breaking Down Two Simple Vulnerabilities That Exposed A School’s Admission Records beginner Bug Bounty | Security researchers discovered data-exposure vulnerabilities on a school's website, revealing sensitive admission records containing PII like names, emails, and addresses. The `/print-form.php?app_number=` endpoint was vulnerable to Insecure Direct Object Reference (IDOR), allowing access to records by manipulating application numbers. → infosecwriteups.com |
| 2026-06-19 2026 | Build an IDOR Vulnerability Lab: Why WHERE Clauses Don’t Protect Your API. intermediate API Sec | Last time we covered SQL injection . I promised IDOR was next. Today you are going to see why a WHERE clause alone will not save you. When you learn about backend APIs feeding your frontend, you are r... → infosecwriteups.com |
| 2026-06-19 2026 | “Bug Bounty Bootcamp #47: Account Takeover 101 — How to Steal Everyone’s Account (Legally)” beginner AuthZ | This article, "Bug Bounty Bootcamp #47: Account Takeover 101," explains that hackers don't need advanced skills to achieve account takeovers. Common vulnerabilities like Insecure Direct Object References (IDOR), insecure invite links, or misconfigured "role" fields can be exploited. The piece encourages readers to learn these techniques legally through bug bounty programs. No specific payout amount is mentioned. → infosecwriteups.com |
| 2026-06-12 2026 | Hacking a Fortune 500 Finance Company via Envoy Proxy Misconfiguration intermediate | A security researcher discovered a vulnerability at a Fortune 500 finance company by exploring their websites. While most domains required SSO credentials, a sister website accessible via Google Dorking allowed verified authors to publish articles. This avenue was initially used to understand the company's systems. The content doesn't mention a specific bug bounty payout amount. → infosecwriteups.com |
| 2026-06-11 2026 | Researcher Used AI to Find $500000 Worth of Bugs Across Google's Internal APIs news 4 min read | Writeup detailing how an AI-powered fuzzing pipeline, utilizing Anthropic's Claude and over 3,600 API keys extracted from 60,000 APKs, uncovered vulnerabilities across Google's internal APIs, including IDOR and broken access control. This systematic approach identified significant security flaws in services like Google Voice, AdExchange, YouTube's Content ID API, Widevine DRM, Eldar, PLX/DataHub, and Vertex AI Search, leading to over $500,000 in bug bounty payouts. The research highlights a pattern of exposed internal APIs and missing authorization checks. |
| 2026-05-12 2026 | Max's Bug Bounty: Two Hundred Thirteen Flaws and Twenty-Two Million in Rewards news 1 min read | Analysis of Max's Bug Bounty program reveals over 213 vulnerabilities identified, with Insecure Direct Object Reference (IDOR) being the most prevalent. The program, which has paid out over 21.9 million rubles, highlights the effectiveness of bug bounty initiatives in improving application security. |
| 2026-04-22 2026 | New Types of Hacking: IDOR Attacks Evolved advanced | New Types of Hacking: IDOR Attacks Evolved |
| 2026-04-22 2026 | Hunting for IDOR and BAC in B2B Apps with Burp Authorize intermediate | Hunting for IDOR and BAC in B2B Apps with Burp Authorize |
| 2026-04-22 2026 | CVE-2025-14371: TaxoPress IDOR / Object-Level Authorization Bypass news 4 min read | Writeup of CVE-2025-14371 affecting TaxoPress, detailing an object-level authorization bypass allowing authenticated users with Contributor+ roles to add or remove tags on posts they do not own. This IDOR vulnerability manipulates content integrity by altering search relevance, internal navigation, feeds, and SEO, enabling attackers to reshape content discovery and editorial placement without direct post editing capabilities. The flaw in `modules/taxopress-ai/classes/TaxoPressAiAjax.php` fails to perform a per-object permission check (`current_user_can( 'edit_post', $post_id )`). |
| 2026-04-22 2026 | IDOR-Scanner: Burp Suite Extension for Automated IDOR Detection intermediate 3 min read | Extension for Burp Suite that automatically detects Insecure Direct Object Reference (IDOR) vulnerabilities. It passively scans HTTP requests and responses for numeric fields in URL paths, query parameters, JSON, and form data. Actively, it increments these numeric fields, sending modified requests to identify confirmed IDORs by checking for differing response sizes and 200 OK statuses. An option to right-click and scan specific issues is also provided. |
| 2026-04-22 2026 | GraphQL IDOR Vulnerabilities: What They Are and How to Fix beginner 8 min read | Library focusing on preventing Insecure Direct Object References (IDOR) in GraphQL APIs. It details how IDOR vulnerabilities arise from improper validation of object identifiers, allowing unauthorized data access. The resource highlights real-world examples like vulnerabilities in PayPal, Vimeo, and Shopify, and provides practical advice on implementing strong authentication and strict authorization checks within GraphQL resolvers to mitigate these risks. → escape.tech |
| 2026-04-22 2026 | CVE-2025-64431: IDOR in ZITADEL Organization API Allows Cross-Tenant Tampering news | Library for detecting CVE-2025-64431, an Insecure Direct Object Reference (IDOR) vulnerability in ZITADEL's Organization V2Beta API. This flaw allows authenticated administrators in one organization to tamper with data in other organizations. The vulnerability is addressable through GitLab Dependency Scanning, which helps secure the software supply chain by identifying disclosed vulnerabilities in open-source dependencies. → advisories.gitlab.com |
| 2026-04-22 2026 | OpenCTI GraphQL IDOR Allows Workspace Content Deletion news 1 min read | Library for identifying and mitigating vulnerabilities in applications. This entry focuses on a GraphQL IDOR in OpenCTI (GHSA-pr6m-q4g7-342c) affecting its "WorkspacePopoverDeletionMutation." The flaw permits authenticated users to delete other users' workspace content, including dashboards and investigation cases, by bypassing ownership checks, leading to data loss and operational disruption. |
| 2026-04-22 2026 | CVE-2025-2271: IDOR Vulnerability Detail news | CVE-2025-2271: IDOR Vulnerability Detail |
| 2026-04-22 2026 | CVE-2025-1270: IDOR in h6web by Anapi Group news | Library for detecting and mitigating Insecure Direct Object Reference (IDOR) vulnerabilities, exemplified by CVE-2025-1270 in Anapi Group's h6web. This vulnerability allows authenticated attackers to access other users' information and impersonate them by manipulating the “pkrelated” parameter in the “/h6web/ha_datos_hermano.php” endpoint. Exploiting this IDOR can grant attackers elevated privileges for subsequent requests. |
| 2026-04-19 2026 | IDOR Vulnerability Exploitation Guide — RedfoxSec beginner 7 min read | Guide to Insecure Direct Object Reference (IDOR) vulnerabilities, a critical OWASP Top 10 risk. This resource details how IDORs occur when applications trust user-provided object references without proper authorization checks, enabling unauthorized access to sensitive data. It covers common exploitation techniques like incrementing integer IDs, predictable GUIDs, and path traversal with examples using tools like Burp Suite Intruder and `curl`. The guide also discusses horizontal and vertical IDOR, provides a methodology for discovery, and highlights the importance of testing PUT, DELETE, and PATCH requests, along with harvesting object references from API responses. |
| 2026-04-19 2026 | Bykea: IDOR on In-App Hardcoded Zombie — HackerOne intermediate | Bykea: IDOR on In-App Hardcoded Zombie — HackerOne → hackerone.com |
| 2026-04-19 2026 | IDOR Vulnerability — HackerOne Report 2633771 intermediate | IDOR Vulnerability — HackerOne Report 2633771 → hackerone.com |
| 2026-04-19 2026 | Top 235 IDOR Bug Bounty Reports beginner | Top 235 IDOR Bug Bounty Reports |
| 2026-04-17 2026 | From Reset to Takeover: IDOR in Password Recovery Systems intermediate | From Reset to Takeover: IDOR in Password Recovery Systems |
| 2026-04-17 2026 | IDOR on Password Change to Full Account Takeover intermediate | IDOR on Password Change to Full Account Takeover |
| 2026-04-17 2026 | Vulnlab: IDOR Writeup (Ikhlasdansantai) intermediate | Vulnlab: IDOR Writeup (Ikhlasdansantai) |
| 2026-04-17 2026 | Critical IDOR Vulnerability Leads to User Information Disclosure intermediate | Critical IDOR Vulnerability Leads to User Information Disclosure |
| 2026-04-17 2026 | API1:2019 - Broken object level authorization beginner | Library for preventing API1:2019 Broken Object Level Authorization (IDOR) vulnerabilities. It outlines how attackers substitute resource IDs to access unauthorized data, providing examples such as manipulating `/api/shop1/financial_info`. Prevention techniques include implementing user policy checks, avoiding reliance on client-sent IDs, verifying authorization for every request, and utilizing non-guessable IDs like UUIDs. |
| 2026-04-17 2026 | A Beginner's Guide to IDOR Testing Methodology beginner | A Beginner's Guide to IDOR Testing Methodology |
| 2026-04-17 2026 | Maximizing IDOR Detection with Burp Suite's Autorize intermediate 9 min read | Library for Burp Suite's Autorize extension, this resource details how to leverage it for identifying Insecure Direct Object Reference (IDOR) vulnerabilities by automatically testing authorization with low-privileged user session cookies. It explains the extension's functionality, including its enforcement status detection and customizable filters for identifying authorization bypasses, and provides installation and usage instructions with examples against OWASP Juice Shop. |
| 2026-04-17 2026 | Manual and semi-automated testing for IDORs using Burp Suite intermediate 3 min read | Library for semi-automated and manual testing of Insecure Direct Object References (IDORs) using Burp Suite. It details how to leverage the Autorize plugin for automated checks by sending captured requests from different user contexts and offers a manual approach by identifying and manipulating object identifiers within Burp Suite's Repeater tool, referencing PortSwigger labs as an example. |
| 2026-04-17 2026 | Testing for IDORs (PortSwigger Burp docs) beginner 2 min read | Library for testing Insecure Direct Object References (IDORs), a common access control vulnerability where an application directly uses user-supplied input to access objects. This resource guides users through identifying potential IDORs in parameters, forwarding requests to Burp Intruder, configuring a Sniper attack with payload positions, and analyzing responses to confirm unauthorized access, using an example involving a user ID parameter. → portswigger.net |
| 2026-04-17 2026 | IDOR Vulnerability Explained: Why IDOR Persists (Aikido) beginner 9 min read | Library for identifying Insecure Direct Object References (IDORs), a prevalent vulnerability in modern, API-driven applications. This resource details how IDORs manifest in practice, why traditional testing methods and DAST tools often miss them, and the limitations of static analysis in detecting these contextual authorization failures. It highlights that IDORs, also known as Broken Object Level Authorization (BOLA) in APIs, persist due to evolving system design and the assumption of ownership rather than revalidation, leading to potential data breaches and unauthorized modifications. → aikido.dev |
| 2026-04-17 2026 | How I Found a Critical IDOR Leading to Full Account Takeover intermediate | How I Found a Critical IDOR Leading to Full Account Takeover |
| 2026-04-17 2026 | A Journey from IDOR to Account Takeover (Payatu) intermediate 1 min read | Writeup detailing an Insecure Direct Object Reference (IDOR) vulnerability leading to account takeover on pyrus.com. The attack exploits a flaw in the email change confirmation process where the UserID parameter can be manipulated to change a victim's email address. Subsequently, by initiating a password reset, the attacker can receive the reset token on their own email, thereby gaining full account control. |
| 2026-04-17 2026 | Tackling IDOR on UUID based objects (PenTester Nepal) intermediate | Tackling IDOR on UUID based objects (PenTester Nepal) |
| 2026-04-17 2026 | How an IDOR Vulnerability Led to User Profile Modification (HackerOne) intermediate 6 min read | Writeup detailing an Insecure Direct Object Reference (IDOR) vulnerability found on mtnmobad.mtnbusiness.com.ng, which allowed remote users to modify account information including phone numbers. The vulnerability arose from the improper validation of account identifiers and exposed user data in HTTP requests and responses. The report highlights how easily identifiable parameters, such as short numerical IDs and email addresses, can be exploited by attackers using automated tools for unauthorized access and account takeover, emphasizing the need for robust access controls and cryptographically strong identifiers. → hackerone.com |
| 2026-04-17 2026 | IDOR: Admin-to-Owner Account Takeover via Password Reset (StudioCMS) intermediate 2 min read | Writeup of an IDOR vulnerability in StudioCMS allowing admin-to-owner account takeover. The POST /studiocms_api/dashboard/create-reset-link endpoint incorrectly allows any authenticated admin to generate a password reset token for any user, including the owner, without role hierarchy validation. This, combined with the POST /studiocms_api/dashboard/reset-password endpoint, enables a complete account takeover of the highest-privileged account in the system. |
| 2026-04-17 2026 | Exploiting UUIDs in Account Takeover: Pentester's Guide intermediate | Exploiting UUIDs in Account Takeover: Pentester's Guide |
| 2026-04-17 2026 | Top 25 IDOR Bug Bounty Reports (Cristian Cornea) intermediate Bug Bounty | Top 25 IDOR Bug Bounty Reports (Cristian Cornea) → corneacristian.medium.com |
| 2026-04-17 2026 | Day 39: IDOR report - How to write a good bounty write-up beginner | Day 39: IDOR report - How to write a good bounty write-up |
| Browse all 101 Insecure Direct Object Reference (IDOR) resources → | ||
Frequently Asked Questions
- What is an IDOR vulnerability?
- IDOR (Insecure Direct Object Reference) is a type of access control vulnerability where an application exposes internal object references — such as database IDs, filenames, or user identifiers — without proper authorization checks. An attacker can manipulate these references to access other users' data.
- How do you find IDOR vulnerabilities?
- To find IDORs, look for predictable identifiers in API endpoints, URL parameters, and request bodies. Change IDs (numeric, UUID, or encoded values) to those belonging to other users and observe whether the application returns unauthorized data. Testing with two accounts simultaneously is the most effective approach.
- What is the difference between IDOR and BOLA?
- BOLA (Broken Object Level Authorization) is the API-specific term for IDOR, used in the OWASP API Security Top 10. Both describe the same core issue: missing authorization checks when accessing objects by reference. BOLA is the preferred term when discussing API security.
Weekly AppSec Digest
Get new resources delivered every Monday.