RecargaPay: IDOR exposes receipts of all users.

@cablej found an insecure direct object reference IDOR that could expose receipts from external users. Thanks for helping us make RecargaPay more secure!...

RBKmoney: IDOR in merchant.rbmonkey.com allows deleting eShops of another user

Website merchant.rbmonkey.com was exposed to an insecure direct object reference vulnerability IDOR which may allow an attacker to deleting shop objects of another user...

New Relic: Bypass of my two other reports #267636 + #255894 - (IDOR) Ability to see full name associated with other New Relic accounts

@jonbottarini discovered an issue where names associated with arbitrary existing email addresses can be revealed in the Alerts Notification Channel UI. As with similar previously-reported issues, this was resolved by obfuscating that information before it's presented...

Zomato: [www.zomato.com] IDOR - Leaking all Personal Details of all Zomato Users through an endpoint

Hacker is able to get the PIPersonal Information of any Zomato user...

Cuvva: Insecure Direct Object Reference (IDOR) Allowing me to claim other user's photos (driving license and selfies) as mine

We weren't properly validating the photo fields on customer profiles. Although this couldn't lead to information disclosure or privacy issues, it would have caused various issues with our internal ops systems. Thanks again for another clear and helpful report!...

New Relic: [NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894

Did you think I had fallen of the earth? Fear not - for I have returned. In 255894 you fixed the issue where a person could mass-harvest names of other New Relic users through the user management section. A fix was quickly pushed for this, but now I've found a workaround. I'm reporting this on th...

Zomato: IDOR to cancel any table booking and leak sensitive information such as email,mobile number,uuid

Hacker is able to cancel the other user's table booking, The same request leaked the private information of the user email & mobile no...

Zomato: [www.zomato.com] IDOR - Delete/Deactivate any special menu of any Restaurants from Zomato

@prateek0490 was able to delete and deactivate special menu of any restaurant using IDOR Going through the JS, I found another cool function which looked interesting and vulnerable and indeed it was vulnerable - var...

Zomato: [www.zomato.com] IDOR - Delete/Deactivate ANY/ALL Promos through a Post Request at **clients/promoDataHandler.php**

@prateek0490 found a IDOR issue which can deactivate any special offer in our platform...

HackerOne: IDOR on HackerOne Feedback Review

Hi HackerOne Team, Summary: I have found an IDOR on HackerOne feedback review functionality, below are the following issues. - Security teams can create public feedback to the hacker which is did not submit any report to them, please note that public feedback will be seen on hackers profile. -...

Vanilla: Accessing Private Files Shared in message of other users

Description: ----------- Users can send message to each other as well as attach and share the files as well, and the flow is like once user upload the file on the server, the file get assigned by unique id named MediaIDs which is vulnerable for IDOR. Step To Reproduce: ----------- + Get logged in...

Uber: IDOR in activateFuelCard id allows bulk lookup of driver uuids

Due to an IDOR in the activateFuelCard endpoint, an attacker could enumerate driver UUIDs. When given a sequential card ID number, the endpoint returned a driver’s UUID given, allowing an attacker to gather many driver UUIDs for use in a different attack. Thanks, @cablej!...

OLX: I found a way to instantly take over ads by other users and change them (IDOR)

A local LetGo webpage was vulnerable to Insecure Data Object Reference issue which could have lead to ad hijack or settings change price, description, location. @kciredor discovered this vulnerability and notified us about this. We would like to thank you for this report. Please do not hesitate t...

Pornhub: Private videos can be added to our playlists

The researcher discovered a way to add a user's private videos to a different user's playlist by way of a specially crafted request. Note that it is not possible to view another user's private video using this method IDOR/application logic flaw...

Zomato: Use any User to Follow you (Increase Followers) [IDOR]

@hisham found the IDOR issue in the user followback action...

GSA Bounty: [IDOR] The authenticated user can restart website build or view build logs on any another Federalist account

Description Hi. I found an Insecure Direct Object Reference vulnerability on the http://192.168.119.128:1337/v0/build/ endpoint. F200108 When the user wants to restart the build, next request are sent to the endpoint: "site":,"branch":"master" where siteid is numeric ID of the site. However, this...

Shopify: IDOR [partners.shopify.com] - User with ONLY Manage apps permission is able to get shops info and staff names from inside the shop

SUMMARY ---------- Hello, I have found a permission problem in https://partners.shopify.com that allows a member with only "Manage apps" permission to get various show information and also list the staff account from inside that shop without having access the shop's admin area REPLICATION STEPS...

Cuvva: IDOR spam anyone's cellphone number through Cuvva app link

Good afternoon, The following url https://cuvva-alternate.app.link/ITHZI8FrKB?branchflowtype=deepviewtmta&branchflowid=397220061845644344&branchdesktopdeepviewtype=1 can be used to spam phone numbers remotely. Example POC: Send After grabbing the form code I can spam numbers from my desktop, I...

Nextcloud: IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email

Hi Team, I Was Looking around your website and then I found a subdomain newsletter.nextcloud.com on the main page it shows us 3 Options i choose 1st that was Subscribe to our newsletter , Then I click on this Option and I was Taken to https://newsletter.nextcloud.com/?p=subscribe&id=1 The page...

Radancy: IDOR in editing courses

Description This vulnerability consists in : https://mijn.werkenbijdefensie.nl/instellingen/gegevens/ This vulnerability allows an attacker to edit courses that do not belong to him and remove them from the users account. The edited course ends up in the attackers account, but gets deleted from t...