Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/fID accepts an integer file ID in the URL and returns internal site structure data page IDs, versions, URL paths to anyone who sends a GET request. id:...

Discourse - Private User Field Disclosure via Directory Items IDOR

Discourse prior to 2025.12.2, 2026.1.1, and 2026.2.0 contains an IDOR vulnerability caused by lack of authorization checks on userfieldids parameter in DirectoryItemsControllerindex, letting any user retrieve private user field values, exploit requires no authentication. id: CVE-2026-26265 info:...

Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access

Bookly WordPress plugin = 28.1 contains an insecure direct object reference caused by missing validation on 'conversationid' parameter, letting unauthenticated attackers read and inject messages into any AI booking conversation, exploit requires no authentication. id: CVE-2026-89063 info: name:...

TrakSYS 11.x.x - Sensitive Data Exposure

A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been...

WordPress WPQA <5.5 - Improper Access Control

WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site. id: CVE-2022-1598 info: name: WordPress WPQA 5.5 - Improper Access Control...

Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. id: CVE-2026-6826 info: name: Concrete CMS 9.5.1 - Unauthenticated File Usage Disclosure author: str4k3r severity: medium description: | Concrete CMS 9.5.0 and...

Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)

Concrete CMS = 9.5.0 contains an IDOR caused by insufficient access control in /ccm/frontend/conversations/messagedetail endpoint, letting unauthenticated attackers enumerate conversation messages and attachments. id: CVE-2026-8237 info: name: Concrete CMS = 9.5.0 - Unauthenticated Conversation...

EUVD-2026-117812

Insecure direct object reference IDOR vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private...

CVE-2026-111490

Insecure direct object reference IDOR vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private...

CVE-2026-111490

The MatchPoint API is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the API relies on the actingasuser HTTP header without properly verifying if the requester is authorized to act as the specified user. By manipulating sequential identifiers, an a...

CVE-2026-63217

The open-source CRM software SuiteCRM contains an Insecure Direct Object Reference (IDOR) vulnerability in the generatePdf entry point, affecting versions prior to 7.15.2 and 8.10.2 . The root cause is located in modules/AOS_PDF_Templates/generatePdf.php, where the BeanFactory::getBean() function...

CVE-2026-12400-Exploit

CVE-2026-12400 — FlowForms IDOR: Unauthorized Form Modification Authenticated Contributor+ Insecure Direct Object Reference to Arbitrary Form Modification in FlowForms ≤ 1.1.1 Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2026-12400 CVSS Score| 4.3 — Medium CVSS Vector|...

CVE-2026-90967

The Essential Real Estate WordPress plugin, prior to version 5.3.5 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to verify invoice ownership before rendering data within specific AJAX actions . This allows an authenticated low-privileged user to access and read ...

CVE-2026-86442

The WP Event Manager WordPress plugin, versions prior to 3.4.2 , is vulnerable to an unauthenticated information disclosure and content manipulation flaw. The root cause is a failure to verify the ownership or post type of a user-supplied post identifier during the front-end event submission flow...

EUVD-2026-117154

VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different userid or profileid to endpoints such as GET /front/profile/profileid/report/ and GET...

AIDOR

AIDOR 👁️ - Automated Insecure Direct Object Reference Detector AIDOR Automated IDOR Detector is a professional Bash utility for authorized penetration testers to identify Insecure Direct Object Reference IDOR vulnerabilities in web applications. Detects numerical IDs, parameter patterns, and...

CVE-2026-54377

VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different userid or profileid to endpoints such as GET /front/profile/profileid/report/ and GET...

CVE-2026-54377

The VitaFit cloud API (versions prior to 2026-10-30 ) is vulnerable to an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access another user's private data by supplying different user_id or profile_id values to endpoints such as GET /front/profile/{profile_id}/...

CVE-2026-121945

CoopCycle coopcycle-web versions before 6.20.1 are vulnerable to a broken access control vulnerability. The issue exists because incident operations only verify the ROLE_COURIER permission, allowing any courier to access all incidents. An attacker can enumerate sequential incident IDs and utilize...

CVE-2026-121945 CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint

CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLECOURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/id/action to re-price, canc...