Web
Not rated
BUG BOUNTY WRITEUPS
IDOR writeups
Insecure direct object references: change an ID, get someone else's data. Simple to explain, easy to miss in code review, and still paying out across APIs and mobile backends.
124 reports and writeups from 2024 to 2026. 82 carry a severity from the disclosing platform, 33 of them rated High or Critical. Last updated 2026-10-30.
Latest IDOR reports
Search and filter all writeupsWeb, API
Not rated
GraphQL Vulnerabilities: The Bug Class Most Hunters Still Don’t Know How to Test
Researcher blog2026-10-29
Web, API
Not rated
Web
Not rated
How a Sneaker Order Led Me to an IDOR Vulnerability (and $50)
Medium2026-10-28
Web
Not rated
Web
Not rated
Web
Not rated
I Analyzed 12 IDOR-to-ATO Reports. The Email-Change Endpoint Wins.
InfoSec Write-ups2026-10-18
Web, API
Not rated
IDOR allows user to access report details via reference.json endpoint
HackerOneHackerOne2026-10-01$15,000 bounty
Web, API
Critical
Team membership information returned on API level based on ID
HackerOneNextcloud2026-09-17$200 bounty
Web, API, Cloud
Low
**Unauthenticated IDOR allows modification of payment customer billing information**
HackerOneWeblate2026-08-30
Web
High
Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization
HackerOneDiscourse2026-08-26
Web
Medium
Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating
HackerOneGitHub2026-08-25
Web, Source Code
Medium
TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot
HackerOneNextcloud2026-08-14
Web, Cloud
Medium
Delete any folder for any user within the organization
HackerOneSingleStore2026-07-01
Web
Low
Insecure Direct Object Reference (IDOR) allows creating folders.
HackerOneSingleStore2026-07-01
Web
Low
Missing ownership validation allows cross‑manager tracker–campaign linking
HackerOneRevive Adserver2026-06-25
Web
Medium
Autotranslate DDP Method Exposes Private Messages Without Authentication or Room Access Check
HackerOneRocket.Chat2026-05-25
Web
High
Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modification
HackerOneGitHub2026-05-19
Web, Source Code
Medium
IDOR: autotranslate.translateMessage Full Message Content Leak
HackerOneRocket.Chat2026-05-18
Web
Medium
Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
HackerOneNextcloud2026-05-08
Web, Cloud
Low
Private circle can be added to another circle via API despite visibility restriction
HackerOneNextcloud2026-05-08$150 bounty
Web, API, Cloud
Low
BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data
HackerOneNextcloud2026-04-14
Web, API, Cloud
Medium
IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photos
HackerOneNextcloud2026-04-07
Web, Cloud
Not rated
Access to Deactivated LinkedIn Company Pages via Competitor Analytics API
HackerOneLinkedIn2026-03-24
Web, API
Medium
Add labels to arbitrary issues/prs & compromise github actions label checks
HackerOneGitHub2026-03-19
Web, Source Code
Medium
Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure
HackerOneBasecamp2026-03-16$100 bounty
Web
Low
IDOR to make someone attend or leave an event
HackerOneLinkedIn2026-03-06
Web
Medium
Missing Access Control in MigrationFile allows attacker to upload files to any Migration
HackerOneGitHub2026-03-05
Web
High
WebAuthn app was updated based on public key
HackerOneNextcloud2026-02-06
Web, Cloud
Low
Disclose Hidden Comments on Media Section of hub.vroid.com
HackerOnepixiv2026-01-18$500 bounty
Web
Medium
Unauthenticated Users Can Access Other Users’ Bug Report Attachments via Broken Access Control
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
IDOR Exposes PII of Tens of Thousands of Users and Supervisors
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
Air Force candidate PII + recruitment chat logs accessible via BAC/IDOR on █████████ (very large/significant exposure)
HackerOneU.S. Dept Of Defense2026-01-12
Web
Critical
Missing ownership check in Tables app allows moving columns into tables of other users
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Participants were able to blindly delete poll drafts of other users by ID
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Tables app allowed users to view columns metadata information of any table
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Calendar app allowed booking appointments without the generated token
HackerOneNextcloud2025-12-05
Web, Cloud
Low
IDOR Vulnerability in Banner Deletion
HackerOneRevive Adserver2025-11-19
Web
High
Authentication Bypass in Subscription Management Endpoint
HackerOnelemlist2025-11-17
Web, API
Critical
Arbitrary Read of Another Users private repository without Authorization
HackerOneGitHub2025-09-23$10,000 bounty
Web, Source Code
High
IDOR - Scheduled data leak to other accounts By "projectID"
HackerOneSingleStore2025-08-12
Web
Medium
Unauthorized Access to Private Video Description via Translation API for Private Accounts
HackerOneTikTok2025-06-27
Web, API
Low
Improper Access Control Allows Trip Hijacking and Passenger/Driver PII Disclosure
HackerOneBykea2025-06-26
Web
Medium
IDOR on in-app hardcoded zombie endpoint
HackerOneBykea2025-06-13
Web, API
Medium
Broken Access Control (IDOR) in Booking Detail and Bids Could Leads to Sensitive Information Disclosure
HackerOneBykea2025-06-13
Web
High
Ability to increase any customer offered fare (BAC)
HackerOneBykea2025-06-13
Web
Medium
Lack of Feedback Validation Permits Arbitrary Driver Ratings
HackerOneBykea2025-06-12
Web
Medium
IDOR Vulnerability at AddTagToAssets operation name
HackerOneHackerOne2025-06-08
Web
Medium
IDOR: Account Deletion via Session Misbinding – Attacker Can Delete Victim Account
HackerOneMozilla2025-06-03
Web
High
Information disclosure on IBM training service endpoint
HackerOneIBM2025-04-29
Web, API
Not rated
Sale cancellations from other sellers without restrictions
HackerOneMercadoLibre2025-03-06
Web
Critical
Insecure Direct Object Reference (IDOR) in GraphQL deleteProfileImages Mutation
HackerOneAutodesk2025-02-21
Web, API
High
IDOR on ads.tiktok.com Allows Unauthorized Product Addition
HackerOneTikTok2025-02-20$500 bounty
Web
Low
Insecure Direct Object Reference (IDOR) Vulnerability in Autodesk User Profile
HackerOneAutodesk2025-02-19
Web
Medium
IDOR Vulnerability Allowing Unauthorized Profile Picture Change
HackerOneAutodesk2025-02-19
Web
Medium
Applicant security exam Attachments/Documents accessible through an IDOR/BAC on the custom Apex controller on https://█████.mil
HackerOneU.S. Dept Of Defense2025-02-12
Web
Critical
Insecure direct Object Reference(Horizontal Escalation)
HackerOneMTN Group2025-01-31
Web
Medium
Unauthorized Reservation Cancellation Through IDOR Vulnerability
HackerOneYelp2025-01-29
Web
High
Unauthorized Access to TikTok Account [Private Videos] via API Endpoint
HackerOneTikTok2025-01-24
Web, API
Medium
Sensitive data exposure: █████████ candidate resumes/CVs available to download with no authentication through BAC/IDOR/Improper Salesforce config
HackerOneU.S. Dept Of Defense2024-12-18
Web
High
█████████ when adding branches to your account
HackerOneMars2024-11-26
Web
Critical
Upload profile photo and Pets addition - IDOR
HackerOneMars2024-11-21
Web
High
Share information of Tables app is not limited to affected users
HackerOneNextcloud2024-11-18
Web, Cloud
Low
IDOR in backup recovery functionality
HackerOneAcronis2024-11-13
Web
High
fs.fchown/fchmod bypasses permission model
HackerOneInternet Bug Bounty2024-10-16$249 bounty
Web
Low
IDOR vulnerability leads to Deleting message after leaving/getting banned from group using message ID
HackerOneRocket.Chat2024-10-13
Web
Low
IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage.
HackerOneMTN Group2024-10-05
Web
Critical
IDOR Exposes All Machine Learning Models
HackerOneGitLab2024-10-01$1,160 bounty
Web, AI
Medium
IDOR Leads To User Profile Modification https://mtnmobad.mtnbusiness.com.ng/app/updateUser
HackerOneMTN Group2024-09-18
Web
Critical
Zomatoooo! IDOR in Saved Payments
MediumZomato2024-09-04
Web
Not rated
How I got my first $13500 bounty through Parameter Polluting (HPP)
InfoSec Write-ups2024-08-10$13,500 bounty
Web
Not rated
IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit user
HackerOneReddit2024-08-09
Web
Low
The Butterfly Effect: Turning Overlooked - Misconfigurations into Zero Click Account Takeover
Researcher blog2024-08-07
Web, API
Not rated
A Creative Way To Get Someones YouTube Videos Deleted + A Copyright Strike Against Their YouTube Channel
Researcher blogGoogle (Youtube)2024-07-29
Web
Not rated
Unauth IDOR to mass account takeover without user interaction on the ███████ (https://███████.edu/)
HackerOneU.S. Dept Of Defense2024-07-19
Web
High
IDOR leads to PII Leak
HackerOneU.S. Dept Of Defense2024-07-19
Web
Medium
IDOR leads to view other user Biographical details (Possible PII LEAK)
HackerOneU.S. Dept Of Defense2024-07-19
Web
Medium
Email Takeover leads to permanent account deletion
HackerOneU.S. Dept Of Defense2024-07-19
Web
High
IDOR : Modify other users demographic details
HackerOneU.S. Dept Of Defense2024-07-19
Web
Medium
Bypassing ACLs – IDOR exploitation via HPP
Researcher blog2024-07-09
Web
Not rated
IDOR may allow access to non-public photos
HackerOneFlickr2024-07-06
Web
Medium
IDOR leading unauthenticated attacker to download documents discloses PII of users and soldiers via https://www.█████████/Download.aspx?id= [HtUS]
HackerOneU.S. Dept Of Defense2024-06-27$500 bounty
Web
High
[IDOR] Improper Access Control on Embedded Submission Form
HackerOneHackerOne2024-06-19$2,500 bounty
Web
Low
IDOR on HackerOne Embedded Submission Form
MediumHackerOne2024-06-19$2,500 bounty
Web, API
Not rated
IDOR to view order information of users and personal information
HackerOneWakaTime2024-06-02
Web
Not rated
Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint
HackerOneHackerOne2024-05-23
Web, API
Critical
IDOR - Leaking of team data (name, email, ID, member ID) via POST /api/v1/graphql `FetchMemberships` operation
HackerOneTools for Humanity2024-05-09$500 bounty
Web, API
Medium
Insecure Direct Object Reference Protection bypass by changing HTTP method in IBM Your Learning endpoint.
HackerOneIBM2024-05-01
Web, API
Critical
Attachment disclosure via summary report
HackerOneHackerOne2024-04-29
Web
Critical
How I was able to discover ATO Via IDOR vulnerability
Medium2024-04-28
Web
Not rated
Taking over accounts in multiple ways
Researcher blog2024-04-17
Web
Not rated
Using E-Notation to bypass Access Control restrictions to access arbitrary user PII-discussions
Medium2024-04-12
Web
Not rated
Bypassing an IDOR A couple of times — $$$$
Medium2024-03-20$2,000 bounty
Web
Not rated
Unauthorized Access to Offline Publication Cover Pages via SOURCE_DOCUMENT_ID
HackerOnePublitas2024-03-13
Web
Medium
An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.
HackerOneLinkedIn2024-03-12
Web
High
IDOR vulnerability reveals additional information
HackerOneSemrush2024-03-07
Web
Critical
IDOR on Delete Email address features
HackerOneMozilla2024-03-07
Web
High
IDOR allows information disclosure
HackerOneSemrush2024-03-05
Web
High
We Hacked Google A.I. for $50,000
Researcher blogGoogle2024-03-04$50,000 bounty
Web, API, AI
Not rated
$20,300 Bounties from a 200 Hour Hacking Challenge
Researcher blog2024-03-04$20,300 bounty
Web
Not rated
Account Takeover [It Looked Secure at First]
Medium2024-02-15
Web
Not rated
IDOR in one subdomain of █████████ -> change information of pets without athorization!
HackerOneMars2024-02-14
Web
Medium
IDOR on GraphQL queries BillingDocumentDownload and BillDetails
HackerOneShopify2024-02-08$5,000 bounty
Web, API
Medium
Disclose private mockups for other users in facebook Creative Hub
Researcher blogMeta / Facebook2024-01-30
Web
Not rated
Persistent Distorted Posts Issue and Unremovable Content in Facebook Group
Researcher blogMeta / Facebook2024-01-30
Web
Not rated
Break saved option for other users in facebook – From N/A to valid bug
Researcher blogMeta / Facebook2024-01-30
Web
Not rated
Bypass Admin approval, Mute Member and Posting Permissions for Only admins in Facebook groups
Researcher blogMeta / Facebook2024-01-30
Web
Not rated
IDOR to account takeover on POST to █████████ by changing member_id parameter
HackerOneMars2024-01-30
Web
Critical
Add comment on a private Oculus Developer support
Researcher blogMeta / Facebook2024-01-30
Web
Not rated
Send messages through notification to facebook & workplace users without getting blocked
Researcher blogMeta / Facebook2024-01-30
Web
Not rated
Sign up for Brand Collabs Manager on behalf of other page admins – Privilege Escalation
Researcher blogMeta / Facebook2024-01-30
Web
Not rated
Disclose latest stream video asset earnings for any gaming streamer page
Researcher blogMeta / Facebook2024-01-30
Web
Not rated
Web
Not rated
How to Discover IDOR from a Blank Page — Bug Bounty Tuesday
Medium2024-01-17$200 bounty
Web
Not rated
Unauthorized Disclosure of Video Thumbnails in Facebook Workplace
Researcher blogMeta / Facebook2024-01-17
Web
Not rated
How I was able to delete any image in Facebook community question forum
Researcher blogMeta / Facebook2024-01-17
Web
Not rated
Adding Descriptions to Instagram Posts on Behalf of Other Users
Researcher blogMeta / Facebook (Instagram)2024-01-16
Web
Not rated
Disclose private attachments in Facebook Messenger Infrastructure
Researcher blogMeta / Facebook (Instagram)2024-01-15
Web
Not rated
View Repo and Title of Any Private Check Run
HackerOneGitHub2024-01-08
Web
Medium
How I Prevented a Mass Data Breach - $15,000 bounty - @bxmbn
Medium2024-01-05$15,000 bounty
Web
Not rated
I received a Bank offer in my mailbox and discovered an IDOR vulnerability - $5,000 bounty - @bxmbn
Medium2024-01-05$5,000 bounty
Web
Not rated
Genie Aladdin Connect Retrofit Garage Door Opener: Multiple Vulnerabilities
Researcher blogThe Genie Company (Aladdin Connect)2024-01-03
Android
Not rated
Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise
Researcher blogPandoraFMS2024-01-02
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.