IDOR

Definitions

1. Insecure Direct Object Reference — a vulnerability where an application exposes internal object IDs (user IDs, file names, database keys) in API endpoints without access control checks. Attackers change the ID to access other users' data. The #1 most common API vulnerability. Fixed by checking authorization on every request, not just authentication.

   In plain English: When changing an ID number in a URL lets you see someone else's data because the server doesn't check if you're allowed.

   Example: "Changing /api/invoices/1234 to /api/invoices/1235 showed another company's invoice — classic IDOR, no authorization check."

Related Terms

• Privilege Escalation
• Webhook Secret
• Dependency Confusion
• Clickjacking
• Supply Chain Security
• RBAC
• ABAC
• API Key vs Token
• Policy Engine
• FedRAMP
• MPA