Insecure Direct Object Reference

Changing the ID in a URL and getting someone else’s record — the simplest serious bug on the web.

Specifications & Metrics

cwe

CWE-639

impact

Unauthorized data access

Core Principles & Analysis

• Sequential identifiers plus missing authorization checks equal a full data walk.
• Its API incarnation, broken object level authorization, tops the OWASP API Security list.
• The fix is authorization on every object access, not obscuring the identifiers.