New Relic: [NR Synthetics] (IDOR) Ability to see full name associated with other New Relic accounts through workaround of #255894

Did you think I had fallen of the earth? Fear not - for I have returned. In 255894 you fixed the issue where a person could mass-harvest names of other New Relic users through the user management section. A fix was quickly pushed for this, but now I've found a workaround. I'm reporting this on th...

Zomato: IDOR to cancel any table booking and leak sensitive information such as email,mobile number,uuid

Hacker is able to cancel the other user's table booking, The same request leaked the private information of the user email & mobile no...

Zomato: [www.zomato.com] IDOR - Delete/Deactivate any special menu of any Restaurants from Zomato

@prateek0490 was able to delete and deactivate special menu of any restaurant using IDOR Going through the JS, I found another cool function which looked interesting and vulnerable and indeed it was vulnerable - var...

Zomato: [www.zomato.com] IDOR - Delete/Deactivate ANY/ALL Promos through a Post Request at **clients/promoDataHandler.php**

@prateek0490 found a IDOR issue which can deactivate any special offer in our platform...

HackerOne: IDOR on HackerOne Feedback Review

Hi HackerOne Team, Summary: I have found an IDOR on HackerOne feedback review functionality, below are the following issues. - Security teams can create public feedback to the hacker which is did not submit any report to them, please note that public feedback will be seen on hackers profile. -...

Vanilla: Accessing Private Files Shared in message of other users

Description: ----------- Users can send message to each other as well as attach and share the files as well, and the flow is like once user upload the file on the server, the file get assigned by unique id named MediaIDs which is vulnerable for IDOR. Step To Reproduce: ----------- + Get logged in...

Uber: IDOR in activateFuelCard id allows bulk lookup of driver uuids

Due to an IDOR in the activateFuelCard endpoint, an attacker could enumerate driver UUIDs. When given a sequential card ID number, the endpoint returned a driver’s UUID given, allowing an attacker to gather many driver UUIDs for use in a different attack. Thanks, @cablej!...

OLX: I found a way to instantly take over ads by other users and change them (IDOR)

A local LetGo webpage was vulnerable to Insecure Data Object Reference issue which could have lead to ad hijack or settings change price, description, location. @kciredor discovered this vulnerability and notified us about this. We would like to thank you for this report. Please do not hesitate t...

Pornhub: Private videos can be added to our playlists

The researcher discovered a way to add a user's private videos to a different user's playlist by way of a specially crafted request. Note that it is not possible to view another user's private video using this method IDOR/application logic flaw...

Zomato: Use any User to Follow you (Increase Followers) [IDOR]

@hisham found the IDOR issue in the user followback action...

GSA Bounty: [IDOR] The authenticated user can restart website build or view build logs on any another Federalist account

Description Hi. I found an Insecure Direct Object Reference vulnerability on the http://192.168.119.128:1337/v0/build/ endpoint. F200108 When the user wants to restart the build, next request are sent to the endpoint: "site":,"branch":"master" where siteid is numeric ID of the site. However, this...

Shopify: IDOR [partners.shopify.com] - User with ONLY Manage apps permission is able to get shops info and staff names from inside the shop

SUMMARY ---------- Hello, I have found a permission problem in https://partners.shopify.com that allows a member with only "Manage apps" permission to get various show information and also list the staff account from inside that shop without having access the shop's admin area REPLICATION STEPS...

Cuvva: IDOR spam anyone's cellphone number through Cuvva app link

Good afternoon, The following url https://cuvva-alternate.app.link/ITHZI8FrKB?branchflowtype=deepviewtmta&branchflowid=397220061845644344&branchdesktopdeepviewtype=1 can be used to spam phone numbers remotely. Example POC: Send After grabbing the form code I can spam numbers from my desktop, I...

Nextcloud: IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email

Hi Team, I Was Looking around your website and then I found a subdomain newsletter.nextcloud.com on the main page it shows us 3 Options i choose 1st that was Subscribe to our newsletter , Then I click on this Option and I was Taken to https://newsletter.nextcloud.com/?p=subscribe&id=1 The page...

Radancy: IDOR in editing courses

Description This vulnerability consists in : https://mijn.werkenbijdefensie.nl/instellingen/gegevens/ This vulnerability allows an attacker to edit courses that do not belong to him and remove them from the users account. The edited course ends up in the attackers account, but gets deleted from t...

Mail.ru: IDOR in tender.mail.ru leading to Information Disclosure

tender.mail.ru could partially leak information about few organizations with accounts in incomplete registration state. Information leaked was public non confidential organization registry information, such as name, ИНН ITN, ОГРН PSRN, etc. tender.mail.ru is not currently in bug bounty scope...

Open-Xchange: Unauthorized access to attachments details of Private Calendar appointments (Access control issue)

Hi Team, Description : In calendar folder there is a permission settings where user can be assigned as read only user of it's own objects . User with this permission shouldn't be able to view private appointments and it's attachments . There is request of getting attachment details from server...

Uber: Stored XSS on any page in most Uber domains

Due to two IDOR vulnerabilities in Tealium, it was possible to compromise an administrator’s account and inject arbitrary Javascript into https://tags.tiqcdn.com/utag/uber/, which an attacker could leverage for a stored XSS attack on several Uber domains. Additionally, a Tealium user’s password a...

Radancy: Possible to view and takeover other user's education and courses @ mijn.werkenbijdefensie.nl

Domain and URL: https://mijn.werkenbijdefensie.nl/instellingen/gegevens/tab2 Summary: IDOR vulnerability in editing education/courses Description: It is possible to view and change courses and education of other users also known as an IDOR. It's also possible to save these, and after saving the...

ProjectSend r754 Insecure Direct Object Reference / Authenticaton Bypass

Document Title: =============== ProjectSend r754 - IDOR & Authentication Bypass Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2031 Release Date: ============= 2017-02-21 Vulnerability Laboratory ID VL-ID:...