Insecure Direct Object Reference
High · Access Control
OWASP Top 10:2025 (current)
A01:2025 — Broken Access Control
Historical Top 10:2021 (not current)
A01:2021 — kept for older reports; use 2025 above.
CWE
CWE-639
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
OWASP A01:2025 · OWASP A01:2021 · CWE-639
Definition
Changing an identifier exposes other users' data.
Root cause
Missing per-object authorization checks.
Affected components
- REST object IDs
- File download endpoints
- Multi-tenant APIs
Impact
Mass data exposure.
Severity
High
Safe lab reproduction
OWASP Juice Shop basket challenge
Detection methodology
Authorization tests with two accounts, access logs.
Evidence examples
- Two-user lab: swap ID → foreign object
Remediation
Enforce ownership checks server-side on every request.
Secure coding examples
Check "can this user access this object?" in every handler.
Related CYNARKS lessons & labs
Tools: burp
Primary 2025 class: A01:2025 — Broken Access Control
Practise related skills in Labs or deepen on Academy library.