The newest Insecure Direct Object Reference (IDOR) resources are on the Insecure Direct Object Reference (IDOR) page. For a reading order instead of a date order, see the Insecure Direct Object Reference (IDOR) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-08-17 2026 | Introducing Session Switcher. Swap Burp Sessions with One Click! intermediate 4 min read AuthZ Burp | Library for managing Burp Suite HTTP sessions, Session Switcher streamlines authorization testing by allowing users to save and switch between multiple named sessions with a single click directly from the request editor. It automates the tedious process of copying and pasting cookies and headers, reducing errors and improving focus during privilege escalation and IDOR testing. The extension can also auto-update saved sessions by monitoring proxy traffic, ensuring authentication data remains valid throughout an engagement. → blog.doyensec.com |
| 2026-08-13 2026 | ERPNext's Document Follow feature exposed unauthorized data news 5 min read AuthZ | Writeup detailing a vulnerability chain in Frappe's Document Follow feature, affecting ERPNext. The exploit involves three authorization failures: object-level access, field-level data leakage, and persistence of email notifications after permission revocation. These issues, designated CVE-2026-66000, CVE-2026-66058, and CVE-2026-66059, allowed unauthorized users to follow any document and receive updates containing sensitive information. |
| 2026-07-30 2026 | Account Takeover Across Multiple Programs via Featurebase Integration intermediate 2 min read AuthZ Bug Bounty | Writeup detailing an IDOR vulnerability in the Featurebase feedback platform, leading to account takeover (ATO). The issue stems from Featurebase trusting client-controlled identity attributes without validation, allowing attackers to impersonate other users by modifying `userId` in API requests or changing user profiles and obtaining access tokens. The author notes Featurebase's stance that this is a website owner's responsibility to fix, but suggests JWT for securing installations. → infosecwriteups.com |
| 2026-07-29 2026 | Unprotected admin functionality — PortSwigger Access control vulnerabilities Lab 1 beginner 2 min read AuthZ Bug Bounty | Writeup detailing the exploitation of Broken Access Control (BAC-Portswigger-001) in a PortSwigger lab, where an unprotected administrator panel was discoverable via the `robots.txt` file. An unauthenticated attacker can access the `/administrator-panel` endpoint, allowing sensitive actions like deleting user accounts, leading to full application compromise. Remediation involves enforcing authentication, implementing authorization checks, and avoiding reliance on `robots.txt` for security. → infosecwriteups.com |
| 2026-07-29 2026 | How I found an IDOR in Google Classroom on Day 3 of my Hunting? beginner 3 min read API Sec Bug Bounty | Writeup detailing an Insecure Direct Object Reference (IDOR) vulnerability discovered in Google Classroom. The vulnerability stemmed from the `batchexecute` system, an undocumented internal RPC protocol. By manipulating `submission ID` parameters within POST requests to the `batchexecute` endpoint, an attacker could post private comments to any student's assignment submission, bypassing intended authorization controls and making the comment visible to the student and teacher. The writeup also explains how submission IDs were discoverable through traffic analysis. → infosecwriteups.com |
| 2026-07-18 2026 | The $0 IDOR That Was Worth More Than a $12,500 P1 intermediate 1 min read Bug Bounty | Writeup analyzing Insecure Direct Object Reference (IDOR) vulnerabilities, contrasting a GraphQL alias abuse bug that garnered a $12,500 bounty with an IDOR exposing all user data for over three years that received $0. The analysis highlights how true impact, beyond proof-of-concept screenshots, dictates bug bounty payouts, noting the latter IDOR was triaged as "Informative" and remained exploitable for years. → infosecwriteups.com |
| 2026-07-18 2026 | How I Found a Cross-Student IDOR in Academy LMS That Leaked Correct Quiz Answers intermediate 8 min read AuthZ | Writeup of a Cross-Student IDOR vulnerability in Academy LMS plugin, affecting over 2,000 installations. The vulnerability, discovered by analyzing the plugin's API controllers, allowed any enrolled student to view another student's quiz results and obtain correct answers. This was achieved by exploiting two authorization failures in the `get_student_quiz_attempt_details` endpoint, which incorrectly processed the `user_id` parameter from requests and evaluated access permissions against the target user's context rather than the caller's. → infosecwriteups.com |
| 2026-07-07 2026 | Predicting MongoDB ObjectId() continuously in Rocket.Chat advanced 12 min read | Writeup detailing a vulnerability in Rocket.Chat, #3687142, where unauthenticated users can access any uploaded file by predicting its MongoDB ObjectId(). The article explains how the ObjectId() is composed of a timestamp, machine/process ID, and a counter, allowing attackers to enumerate valid file IDs and bypass authorization checks through the Livechat functionality. → aikido.dev |
| 2026-06-20 2026 | Breaking Down Two Simple Vulnerabilities That Exposed A School’s Admission Records beginner Bug Bounty | Security researchers discovered data-exposure vulnerabilities on a school's website, revealing sensitive admission records containing PII like names, emails, and addresses. The `/print-form.php?app_number=` endpoint was vulnerable to Insecure Direct Object Reference (IDOR), allowing access to records by manipulating application numbers. → infosecwriteups.com |
| 2026-06-19 2026 | Build an IDOR Vulnerability Lab: Why WHERE Clauses Don’t Protect Your API. intermediate API Sec | Last time we covered SQL injection . I promised IDOR was next. Today you are going to see why a WHERE clause alone will not save you. When you learn about backend APIs feeding your frontend, you are r... → infosecwriteups.com |
| 2026-06-19 2026 | “Bug Bounty Bootcamp #47: Account Takeover 101 — How to Steal Everyone’s Account (Legally)” beginner AuthZ | This article, "Bug Bounty Bootcamp #47: Account Takeover 101," explains that hackers don't need advanced skills to achieve account takeovers. Common vulnerabilities like Insecure Direct Object References (IDOR), insecure invite links, or misconfigured "role" fields can be exploited. The piece encourages readers to learn these techniques legally through bug bounty programs. → infosecwriteups.com |
| 2026-06-12 2026 | Hacking a Fortune 500 Finance Company via Envoy Proxy Misconfiguration intermediate | A security researcher discovered a vulnerability at a Fortune 500 finance company by exploring their websites. While most domains required SSO credentials, a sister website accessible via Google Dorking allowed verified authors to publish articles. This avenue was initially used to understand the company's systems. → infosecwriteups.com |
| 2026-06-11 2026 | Researcher Used AI to Find $500000 Worth of Bugs Across Google's Internal APIs news 4 min read | Writeup detailing how an AI-powered fuzzing pipeline, utilizing Anthropic's Claude and over 3,600 API keys extracted from 60,000 APKs, uncovered vulnerabilities across Google's internal APIs, including IDOR and broken access control. This systematic approach identified significant security flaws in services like Google Voice, AdExchange, YouTube's Content ID API, Widevine DRM, Eldar, PLX/DataHub, and Vertex AI Search, leading to over $500,000 in bug bounty payouts. The research highlights a pattern of exposed internal APIs and missing authorization checks. |
| 2026-05-12 2026 | Max's Bug Bounty: Two Hundred Thirteen Flaws and Twenty-Two Million in Rewards news 1 min read | Analysis of Max's Bug Bounty program reveals over 213 vulnerabilities identified, with Insecure Direct Object Reference (IDOR) being the most prevalent. The program, which has paid out over 21.9 million rubles, highlights the effectiveness of bug bounty initiatives in improving application security. |
| 2026-04-22 2026 | New Types of Hacking: IDOR Attacks Evolved advanced | New Types of Hacking: IDOR Attacks Evolved |
| 2026-04-22 2026 | Hunting for IDOR and BAC in B2B Apps with Burp Authorize intermediate | Hunting for IDOR and BAC in B2B Apps with Burp Authorize → thexssrat.medium.com |
| 2026-04-22 2026 | CVE-2025-14371: TaxoPress IDOR / Object-Level Authorization Bypass news 4 min read | Writeup of CVE-2025-14371 affecting TaxoPress, detailing an object-level authorization bypass allowing authenticated users with Contributor+ roles to add or remove tags on posts they do not own. This IDOR vulnerability manipulates content integrity by altering search relevance, internal navigation, feeds, and SEO, enabling attackers to reshape content discovery and editorial placement without direct post editing capabilities. The flaw in `modules/taxopress-ai/classes/TaxoPressAiAjax.php` fails to perform a per-object permission check (`current_user_can( 'edit_post', $post_id )`). |
| 2026-04-22 2026 | IDOR-Scanner: Burp Suite Extension for Automated IDOR Detection intermediate 3 min read | Extension for Burp Suite that automatically detects Insecure Direct Object Reference (IDOR) vulnerabilities. It passively scans HTTP requests and responses for numeric fields in URL paths, query parameters, JSON, and form data. Actively, it increments these numeric fields, sending modified requests to identify confirmed IDORs by checking for differing response sizes and 200 OK statuses. An option to right-click and scan specific issues is also provided. |
| 2026-04-22 2026 | GraphQL IDOR Vulnerabilities: What They Are and How to Fix beginner 8 min read | Library focusing on preventing Insecure Direct Object References (IDOR) in GraphQL APIs. It details how IDOR vulnerabilities arise from improper validation of object identifiers, allowing unauthorized data access. The resource highlights real-world examples like vulnerabilities in PayPal, Vimeo, and Shopify, and provides practical advice on implementing strong authentication and strict authorization checks within GraphQL resolvers to mitigate these risks. → escape.tech |
| 2026-04-22 2026 | CVE-2025-64431: IDOR in ZITADEL Organization API Allows Cross-Tenant Tampering news | Library for detecting CVE-2025-64431, an Insecure Direct Object Reference (IDOR) vulnerability in ZITADEL's Organization V2Beta API. This flaw allows authenticated administrators in one organization to tamper with data in other organizations. The vulnerability is addressable through GitLab Dependency Scanning, which helps secure the software supply chain by identifying disclosed vulnerabilities in open-source dependencies. → advisories.gitlab.com |
| 2026-04-22 2026 | OpenCTI GraphQL IDOR Allows Workspace Content Deletion news 1 min read | Library for identifying and mitigating vulnerabilities in applications. This entry focuses on a GraphQL IDOR in OpenCTI (GHSA-pr6m-q4g7-342c) affecting its "WorkspacePopoverDeletionMutation." The flaw permits authenticated users to delete other users' workspace content, including dashboards and investigation cases, by bypassing ownership checks, leading to data loss and operational disruption. |
| 2026-04-22 2026 | CVE-2025-2271: IDOR Vulnerability Detail news | CVE-2025-2271: IDOR Vulnerability Detail |
| 2026-04-22 2026 | CVE-2025-1270: IDOR in h6web by Anapi Group news | Library for detecting and mitigating Insecure Direct Object Reference (IDOR) vulnerabilities, exemplified by CVE-2025-1270 in Anapi Group's h6web. This vulnerability allows authenticated attackers to access other users' information and impersonate them by manipulating the “pkrelated” parameter in the “/h6web/ha_datos_hermano.php” endpoint. Exploiting this IDOR can grant attackers elevated privileges for subsequent requests. |
| 2026-04-19 2026 | IDOR Vulnerability Exploitation Guide — RedfoxSec beginner 7 min read | Guide to Insecure Direct Object Reference (IDOR) vulnerabilities, a critical OWASP Top 10 risk. This resource details how IDORs occur when applications trust user-provided object references without proper authorization checks, enabling unauthorized access to sensitive data. It covers common exploitation techniques like incrementing integer IDs, predictable GUIDs, and path traversal with examples using tools like Burp Suite Intruder and `curl`. The guide also discusses horizontal and vertical IDOR, provides a methodology for discovery, and highlights the importance of testing PUT, DELETE, and PATCH requests, along with harvesting object references from API responses. |
| 2026-04-19 2026 | Bykea: IDOR on In-App Hardcoded Zombie — HackerOne intermediate | Bykea: IDOR on In-App Hardcoded Zombie — HackerOne → hackerone.com |
| 2026-04-19 2026 | IDOR Vulnerability — HackerOne Report 2633771 intermediate | IDOR Vulnerability — HackerOne Report 2633771 → hackerone.com |
| 2026-04-19 2026 | Top 235 IDOR Bug Bounty Reports beginner | Top 235 IDOR Bug Bounty Reports |
| 2026-04-17 2026 | From Reset to Takeover: IDOR in Password Recovery Systems intermediate | From Reset to Takeover: IDOR in Password Recovery Systems |
| 2026-04-17 2026 | IDOR on Password Change to Full Account Takeover intermediate | IDOR on Password Change to Full Account Takeover |
| 2026-04-17 2026 | Vulnlab: IDOR Writeup (Ikhlasdansantai) intermediate | Vulnlab: IDOR Writeup (Ikhlasdansantai) |
| 2026-04-17 2026 | Critical IDOR Vulnerability Leads to User Information Disclosure intermediate | Critical IDOR Vulnerability Leads to User Information Disclosure |
| 2026-04-17 2026 | API1:2019 - Broken object level authorization beginner | Library for preventing API1:2019 Broken Object Level Authorization (IDOR) vulnerabilities. It outlines how attackers substitute resource IDs to access unauthorized data, providing examples such as manipulating `/api/shop1/financial_info`. Prevention techniques include implementing user policy checks, avoiding reliance on client-sent IDs, verifying authorization for every request, and utilizing non-guessable IDs like UUIDs. |
| 2026-04-17 2026 | A Beginner's Guide to IDOR Testing Methodology beginner | A Beginner's Guide to IDOR Testing Methodology |
| 2026-04-17 2026 | Maximizing IDOR Detection with Burp Suite's Autorize intermediate 9 min read | Library for Burp Suite's Autorize extension, this resource details how to leverage it for identifying Insecure Direct Object Reference (IDOR) vulnerabilities by automatically testing authorization with low-privileged user session cookies. It explains the extension's functionality, including its enforcement status detection and customizable filters for identifying authorization bypasses, and provides installation and usage instructions with examples against OWASP Juice Shop. |
| 2026-04-17 2026 | Manual and semi-automated testing for IDORs using Burp Suite intermediate 3 min read | Library for semi-automated and manual testing of Insecure Direct Object References (IDORs) using Burp Suite. It details how to leverage the Autorize plugin for automated checks by sending captured requests from different user contexts and offers a manual approach by identifying and manipulating object identifiers within Burp Suite's Repeater tool, referencing PortSwigger labs as an example. |
| 2026-04-17 2026 | Testing for IDORs (PortSwigger Burp docs) beginner 2 min read | Library for testing Insecure Direct Object References (IDORs), a common access control vulnerability where an application directly uses user-supplied input to access objects. This resource guides users through identifying potential IDORs in parameters, forwarding requests to Burp Intruder, configuring a Sniper attack with payload positions, and analyzing responses to confirm unauthorized access, using an example involving a user ID parameter. → portswigger.net |
| 2026-04-17 2026 | IDOR Vulnerability Explained: Why IDOR Persists (Aikido) beginner 9 min read | Library for identifying Insecure Direct Object References (IDORs), a prevalent vulnerability in modern, API-driven applications. This resource details how IDORs manifest in practice, why traditional testing methods and DAST tools often miss them, and the limitations of static analysis in detecting these contextual authorization failures. It highlights that IDORs, also known as Broken Object Level Authorization (BOLA) in APIs, persist due to evolving system design and the assumption of ownership rather than revalidation, leading to potential data breaches and unauthorized modifications. → aikido.dev |
| 2026-04-17 2026 | How I Found a Critical IDOR Leading to Full Account Takeover intermediate | How I Found a Critical IDOR Leading to Full Account Takeover |
| 2026-04-17 2026 | A Journey from IDOR to Account Takeover (Payatu) intermediate 1 min read | Writeup detailing an Insecure Direct Object Reference (IDOR) vulnerability leading to account takeover on pyrus.com. The attack exploits a flaw in the email change confirmation process where the UserID parameter can be manipulated to change a victim's email address. Subsequently, by initiating a password reset, the attacker can receive the reset token on their own email, thereby gaining full account control. |
| 2026-04-17 2026 | Tackling IDOR on UUID based objects (PenTester Nepal) intermediate | Tackling IDOR on UUID based objects (PenTester Nepal) |
| 2026-04-17 2026 | How an IDOR Vulnerability Led to User Profile Modification (HackerOne) intermediate 6 min read | Writeup detailing an Insecure Direct Object Reference (IDOR) vulnerability found on mtnmobad.mtnbusiness.com.ng, which allowed remote users to modify account information including phone numbers. The vulnerability arose from the improper validation of account identifiers and exposed user data in HTTP requests and responses. The report highlights how easily identifiable parameters, such as short numerical IDs and email addresses, can be exploited by attackers using automated tools for unauthorized access and account takeover, emphasizing the need for robust access controls and cryptographically strong identifiers. → hackerone.com |
| 2026-04-17 2026 | IDOR: Admin-to-Owner Account Takeover via Password Reset (StudioCMS) intermediate 2 min read | Writeup of an IDOR vulnerability in StudioCMS allowing admin-to-owner account takeover. The POST /studiocms_api/dashboard/create-reset-link endpoint incorrectly allows any authenticated admin to generate a password reset token for any user, including the owner, without role hierarchy validation. This, combined with the POST /studiocms_api/dashboard/reset-password endpoint, enables a complete account takeover of the highest-privileged account in the system. |
| 2026-04-17 2026 | Exploiting UUIDs in Account Takeover: Pentester's Guide intermediate | Exploiting UUIDs in Account Takeover: Pentester's Guide |
| 2026-04-17 2026 | Top 25 IDOR Bug Bounty Reports (Cristian Cornea) intermediate Bug Bounty | Top 25 IDOR Bug Bounty Reports (Cristian Cornea) → corneacristian.medium.com |
| 2026-04-17 2026 | Day 39: IDOR report - How to write a good bounty write-up beginner | Day 39: IDOR report - How to write a good bounty write-up |
| 2026-04-16 2026 | IDOR Vulnerabilities Explained: A Researcher's Guide to Authorization Flaws beginner | IDOR Vulnerabilities Explained: A Researcher's Guide to Authorization Flaws |
| 2026-04-16 2026 | From IDOR to Account Takeover (ATO) intermediate | From IDOR to Account Takeover (ATO) |
| 2026-04-16 2026 | IDOR: A Tale of Account Takeover intermediate | IDOR: A Tale of Account Takeover |
| 2026-04-16 2026 | IDOR Vulnerability Detection Through HTTP Traffic Analysis intermediate 20 min read | Analysis of Insecure Direct Object References (IDOR) attacks, which exploit missing server-side permission verification by allowing manipulation of resource identifiers in URLs, POST forms, REST API requests, cookies, and JSON objects. These attacks, ranging from horizontal (accessing data of users at the same privilege level) to vertical (gaining administrator access), are difficult for traditional firewalls and WAFs to detect as they appear as syntactically correct HTTP requests. Effective detection relies on analyzing HTTP traffic for anomalies like sequential enumeration, unusual error rates (401, 403), or atypical ID values, requiring a combination of preventive developer controls and detective security monitoring. |
| 2026-04-16 2026 | Broken Access Control: Advanced IDOR Exploitation advanced 6 min read | Library for advanced exploitation of broken access control vulnerabilities, focusing on Insecure Direct Object References (IDORs). It covers "object-based" IDORs with JSON manipulation, multi-step IDORs hidden behind workflow sequences, second-order IDORs where input indirectly references resources, and "ID-less" IDORs that bypass direct ID references. Techniques explored include wrapping IDs in arrays, object mapping, boolean usage, and various ID manipulation attempts. |