What is an IDOR Vulnerability?

Insecure direct object references (IDOR) are a type of access control vulnerability where an application exposes internal object identifiers – such as user IDs, order numbers, or file names – without verifying whether the requesting user is authorized to access them.

In the OWASP Top 10 2025, IDOR falls under A01: Broken Access Control – the most critical category of web application risk.

Why IDOR matters to your business:

• Attackers can access other users’ sensitive data with minimal effort

• APIs are especially vulnerable

• Can lead to data breaches, financial loss, and reputational damage

How to prevent IDOR:

• Enforce object-level authorization on every request

• Never trust client-side input for access decisions

• Use queries scoped to the authenticated user

• Test continuously with automated DAST tools

Acunetix applies runtime testing to live applications and APIs, helping uncover IDOR and other authorization weaknesses before attackers do.

Interested in seeing Acunetix in action?

LOGON Software Asia – the trusted Acunetix distributor in Asia – offers:

• Free Proof of Concept (POC)

• Preferred regional pricing

• Priority technical support

• Dedicated local expertise

Find, fix, and prevent vulnerabilities

Acunetix is an application security testing solution for securing your websites, web applications, and APIs

Get started with Acunetix

Book a live demo with our specialist to discover how Acunetix can quickly find and fix the vulnerabilities that put your web applications at risk of attack.