Insecure Direct Object Reference (IDOR) (CWE-639)CVSS 6.5

IDOR leads Unauthorized Staff Member Removal via Insufficient Authorization Checks

March 17, 2026

1 views

€470

Vulnerability Summary

Missing authorization checks allow unauthorized users to remove staff members from accounts they do not own, leading to potential disruption and abuse.

Vulnerability Details

Endpoint:

POST /account/dashboard/accounts HTTP/2

Request Payload:

MemberId=76671&RemoveMember=remove

Identification Required

You must be logged in to read this writeup. Join our community of researchers today.

Sign In Register

Related Writeups

misesop375

2 IDOR’s & WAF Bypass to Expose Full Event Database

During a recent engagement on a food industry B2B platform, I discovered a vulnerability chain that allowed me to dump the entire database of users registered for a corporate event. By chaining a sequential ID enumeration vulnerability with a secondary IDOR on the “Edit Profile” endpoint - and optimizing the attack by identifying a weakness in the ID generation logic - I was able to access the Personally Identifiable Information (PII) of all event attendees.

Read Writeup →

hackerone-reports

Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure

HackerOne disclosed report --> https://hackerone.com/reports/3467641 by perxibes

Read Writeup →

pyus3r

IDOR Leading to Plaintext SFTP Credential Disclosure and Unauthorized SFTP Access

An Insecure Direct Object Reference (IDOR) vulnerability in the organization API allows authenticated users to manipulate the identifier parameter and retrieve plaintext SFTP credentials belonging to other users or organizations, potentially leading to unauthorized access to sensitive files stored on the SFTP server.

LogicalBreach Academy