What Is an IDOR Vulnerability and Why Is It So Dangerous?

What is an IDOR vulnerability and why is it so dangerous?

IDOR — Insecure Direct Object Reference — consistently appears in lists of the most critical web application vulnerabilities. It has been responsible for some of the largest data breaches of the past decade, exposing millions of customer records with attacks that required no sophisticated tools — just a browser and the ability to change a number in a URL.

What IDOR actually means

Most web applications use identifiers to reference objects — database records, user accounts, orders, invoices, files. A typical URL might look like: yoursite.com/orders/12345.

An IDOR vulnerability exists when the application retrieves that order without checking whether the person requesting it is actually allowed to see it. An attacker simply changes 12345 to 12346, 12347 — and if the application does not verify ownership, they can access every other customer's orders.

The attack requires no technical skill. No malware. No exploit code. Just changing a number.

Why IDOR is particularly dangerous

The damage from IDOR is immediate and often massive. In e-commerce applications it can expose order histories, delivery addresses, and payment method details for every customer. In healthcare applications, patient records. In financial applications, account balances.

The business impact

Under UK GDPR, an IDOR vulnerability that allows unauthorised access to personal data constitutes a personal data breach. If exploited, you have 72 hours to report it to the ICO. Fines for IDOR-related breaches have reached hundreds of thousands of pounds for UK businesses.

How IDOR gets fixed

Every time your application retrieves an object based on an identifier, it must verify that the requesting user has permission to access that object. This authorisation check needs to be implemented consistently throughout your application.

Yrzo AI includes IDOR scanning as one of its 75+ automated security checks. Starting at £149.