Glossary: Application and Credential Attacks, and AI Risks

insecure direct object reference (IDOR)

Also written: IDOR

A missing ownership check, where changing an ID in a web address, such as the order number in /orders?id=1042, shows someone else's data. It is a form of broken access control and causes horizontal privilege escalation.