IDOR
HighInsecure Direct Object Reference
Definition
Insecure Direct Object Reference (IDOR) is an access-control vulnerability where the application exposes direct references to internal objects (such as database IDs) without verifying that the user is authorized to access them. An attacker can tamper with these references to reach other users' data.
Impact
Access to other users' personal dataModification of other people's profiles, orders or settingsDownloading other users' confidential documentsDeletion of other users' resourcesHorizontal privilege escalation
Examples
IDOR in a profile endpoint
The server does not verify that the authenticated user's token matches the requested ID. It simply returns the data of the provided ID, granting access to any profile.
# Legitimate request (my profile, ID 1001) GET /api/users/1001/profile Authorization: Bearer <my_token> # Change the ID to access another user's profile GET /api/users/1002/profile Authorization: Bearer <my_token> # The server returns user 1002's data without checking authorization
IDOR in document downloads
The invoice identifiers are predictable and sequential. The attacker can download any user's invoices simply by changing the number in the URL.
# I download my invoice GET /api/invoices/download/INV-2024-0051 Authorization: Bearer <my_token> # I iterate to download other users' invoices GET /api/invoices/download/INV-2024-0001 GET /api/invoices/download/INV-2024-0002 ...