CWE-639: Authorization bypass through a user-controlled key (IDOR)

3,447 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 228High 1,107Medium 1,924Low 182Not scored 6

CVEs per yearBy the year they were published

CVE-2026-55255
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
langflow-ai · langflow
ExploitedHigh8.4

CVE-2026-123861
WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability
CrocoBlock · JetFormBuilder – Hierarchical Select
Medium5.3
CVE-2026-109991
FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter
teamfunnelkit · FunnelKit Payment Gateway for Stripe WooCommerce
High7.5
CVE-2026-17428
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium5.0
CVE-2026-17405
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High8.8
CVE-2026-17391
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium6.3
CVE-2026-17388
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High8.5
CVE-2026-17387
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High7.7
CVE-2026-17383
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High7.7
CVE-2026-17381
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High8.5
CVE-2026-17376
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High7.7