IDOR
Insecure Direct Object Reference
An access-control vulnerability where changing an object identifier can expose or modify data the requester is not authorized to access.
Plain English
A user can reach someone else's record by manipulating its identifier.
In context
IDOR occurs when a system trusts a supplied identifier without enforcing authorization for the specific object and action on the server.
Example
“The penetration test found an IDOR that exposed another account's invoice by changing the URL identifier.”
When you'll hear this
- security testing
- code review
- incident response
Common misunderstanding
Using unpredictable identifiers can reduce guessing but does not replace object-level authorization checks.
Also known as
insecure direct object reference
Commonly used by
Related terms
Updated: 2026-08-27
