Glossary: Vulnerability, Asset and Change Management

IDOR (insecure direct object reference)

Also written: IDOR, insecure direct object reference

A flaw where an app trusts an ID without checking that the user owns it. In Sam's show_order page, anyone could read any order just by changing the number in the address.