Santosh Kumar Puppala·10h agoThe role check passed, the group check was missing: cross-org IDOR in CiviForm (CVE-2026-107856)A CiviForm Trusted Intermediary could open the edit form of a client outside their own group, because the handler checked the role but…
Santosh Kumar Puppala·3d agoThe viewer checked the domain, the delete button didn’t: cross-tenant quarantine IDOR in MailWatch…In MailWatch 1.2.26, any logged-in user could delete another domain’s quarantined mail by message id. The message viewer refused the same…
Amjadrajawala·5d agoIDOR: The Vulnerability That Hides Behind a Simple RequestUnderstanding how small authorization mistakes can expose an application’s most sensitive data.
msfire·6d agoAuthorization Bypass (IDOR) in WPGraphQLWelcome back, hackers! 😉A response icon1A response icon1
Samadhan shimple·Oct 27IDOR Hunting Techniques Every Bug Bounty Hunter Should Know | by Samadhan ShimpleIDOR is one of the most interesting vulnerabilities to look for during a bug bounty hunt. It can appear in a simple profile page, a…
InRadio HackersbySamadhan shimple·Oct 26One Email Parameter Was All It Took: How Broken Access Control Let Me Create a Folder in Another…A practical bug bounty story about testing authorisation, manipulating request parameters, and finding a potential IDOR vulnerability.
Samadhan shimple·Oct 25How I Use AI to Find Potential IDOR Vulnerabilities: A Practical 6-Step Guide | by Samadhan ShimpleFinding an IDOR vulnerability is not always as simple as changing a number in a URL.
Abdulkadir Kayacan·Oct 22Bir Hacker Gibi Düşünmek — #17IDOR Nedir? Bir URL’deki Sayıyı Değiştirmek Nasıl Yetkisiz Erişime Yol Açabilir?
