不安全的直接对象引用

把 ID 换成别人的就能读写别人的数据。简单，但在 GraphQL、移动端 API 与批量接口里反复出现。

影响

越权读取、修改或删除其他用户的数据

观察点

修改对象 ID 后，接口返回了属于其他用户的数据

修复

在服务端对每个对象访问执行所有权校验，使用不可预测的标识符，并为批量接口补齐权限检查。

弱点分布

• IDOR359
• 违反安全设计原则（按标题归类）3
• Unlabeled2

共现类别

暂无共现数据。

高票报告

当前状态 364 份 · 全部 364 · 筛选赏金 $186,988

1. 801
   Delete anyone's content spotlight remotely.Snapchat · 2023-03-07 · 高危
   $15,000IDOR
2. 797
   IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersPayPal · 2019-07-30 · 高危
   $10,500IDOR
3. 471
   How the Bug stole hackingHackerOne · 2019-12-21 · 低危
   $0IDOR
4. 395
   IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL queryHackerOne · 2023-08-29 · 高危
   $0IDOR
5. 387
   IDOR allow access to payments data of any userNord Security · — · 未评级
   $0IDOR
6. 372
   IDOR allows user to access report details via reference.json endpointHackerOne · 2026-10-01 · 严重
   $15,000IDOR
7. 346
   Insecure Direct Object Reference (IDOR) - Delete CampaignsHackerOne · 2023-05-03 · 高危
   $0IDOR
8. 340
   Attachment disclosure via summary reportHackerOne · 2024-04-29 · 严重
   $0IDOR
9. 276
   Arbitrary Read of Another Users private repository without AuthorizationGitHub · 2025-09-24 · 高危
   $10,000IDOR
10. 267
    Deleting all DMs on RedditGifts.comReddit · 2021-10-22 · 高危
    $5,000IDOR
11. 266
    Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json EndpointHackerOne · 2024-05-24 · 严重
    $0IDOR
12. 266
    idor allows you to delete photos and album from a galleryPornhub · — · 未评级
    $1,500IDOR
13. 260
    Singapore - Account Takeover via IDORStarbucks · 2020-07-29 · 严重
    $0IDOR
14. 254
    Steal private objects of other projects via project importGitLab · 2022-06-07 · 严重
    $20,000IDOR
15. 248
    IDOR allows any user to edit others videosPornhub · — · 未评级
    $1,500IDOR
16. 244
    IDOR: Account Deletion via Session Misbinding – Attacker Can Delete Victim AccountMozilla · 2025-06-03 · 高危
    $0IDOR
17. 233
    Insecure redirect rule results in bypassing ban redirect on certain pagesRoblox · 2020-04-26 · 中危
    $0IDOR
18. 232
    An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashierUnikrn · 2023-07-17 · 高危
    $0IDOR
19. 216
    IDOR delete any Tickets on ads.tiktok.comTikTok · 2022-03-03 · 高危
    $0IDOR
20. 214
    I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD)Yelp · 2020-08-19 · 严重
    $0IDOR
21. 210
    IDOR vulnerability in unreleased HackerOne Copilot featureHackerOne · 2023-10-26 · 中危
    $0IDOR
22. 208
    IDOR allows an attacker to modify the links of any userReddit · 2022-09-30 · 高危
    $0IDOR
23. 202
    IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignalAutomattic · 2020-11-18 · 严重
    $0IDOR
24. 187
    IDOR on GraphQL queries BillingDocumentDownload and BillDetailsShopify · 2024-02-08 · 中危
    $5,000IDOR
25. 186
    read new emails from any inbox IOS APP in notification centerMail.ru · — · 未评级
    $10,000IDOR