#IDOR
14 postsBugForge - Daily - Copy Pasta (Jun 25, 2026)
A broken access control flaw in collection sharing. A public collection share endpoint returns the contents of every assigned snippet without re-checking each snippet's own visibility, allowing a private snippet to be leaked by adding it to a public collection…
BugForge - Daily - Ottergram (Feb 28, 2026)
The Ottergram application contains an HTTP Verb Tampering vulnerability combined with an Insecure Direct Object Reference (IDOR) flaw in its comment…
BugForge - Daily - Gift Lab (Feb 19, 2026)
The Gift Lab application contains an Insecure Direct Object Reference (IDOR) vulnerability in its list sharing functionality. The application generates…
BugForge - Daily - Cafe Club (Feb 8, 2026)
This challenge exploits an Insecure Direct Object Reference (IDOR) vulnerability in the profile password update functionality. The application includes the…
BugForge - Daily - Ottergram (Jan 31, 2026)
The Ottergram application contains an Insecure Direct Object Reference (IDOR) vulnerability in its profile update functionality. While the application…
BugForge - Daily - Tanuki (Jan 27, 2026)
This challenge demonstrates an Insecure Direct Object Reference (IDOR) vulnerability in the profile update functionality. The application passes the username…
BugForge - Daily - Copy Pasta (Jan 21, 2026)
This issue is a classic example of broken access control caused by trusting user-supplied object identifiers. A password reset endpoint accepts a userId…
BugForge - Daily - Ottergram (Jan 17, 2026)
This walkthrough demonstrates how an Insecure Direct Object Reference (IDOR) can surface in real-time features by moving beyond basic HTTP endpoints and…
BugForge - Daily - Sokudo (Jan 15, 2026)
This challenge demonstrates how legacy API endpoints can introduce critical security vulnerabilities when not properly deprecated or secured. The application…
BugForge - Daily - Copy Pasta (Jan 14, 2026)
After registering a standard user, the application was mapped to understand how snippets are created and managed, with a focus on how snippet IDs are handled…
BugForge - Daily - Tanuki (Jan 13, 2026)
This challenge demonstrates an Insecure Direct Object Reference (IDOR) vulnerability in the Tanuki flashcard application's statistics API endpoint. After…
BugForge - Daily - Ottergram (Jan 10, 2026)
The application exposes a GraphQL API with introspection enabled in production, allowing attackers to query the full API schema and discover sensitive…
BugForge - Daily - Copy Pasta (Jan 7, 2026)
The CopyPasta application allows users to create and share code snippets with options to make them public or private. The snippet retrieval endpoint…
BugForge - Daily - Cheesy Does It (Dec 29, 2025)
This vulnerability is an Insecure Direct Object Reference (IDOR) caused by missing server-side authorization checks when accessing order data. The…