1286
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 863 Incorrect Authorization 1787
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1212 Authorization Errors 2476
MemberOf 840 Business Logic Errors 2360
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Insecure Direct Object Reference / IDOR : The "Insecure Direct Object Reference" term, as
described in the OWASP Top Ten, is broader than this CWE because it also covers path traversal
(CWE-22). Within the context of vulnerability theory, there is a similarity between the OWASP
concept and CWE-706: Use of Incorrectly-Resolved Name or Reference.
CWE Version 4.14
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-639: Authorization Bypass Through User-Controlled Key