CyberGuard dictionary / Web Application Security
Insecure Direct Object Reference
An insecure direct object reference (IDOR) exposes an object through a user-controlled identifier without checking the caller's permission for that object.
In simple terms
Changing a record number in a URL should never let a person see someone else's record.
Technical explanation
IDOR is an object-level authorization failure. The server must evaluate the caller's rights to the specific resource on every request; random identifiers make guessing harder but do not replace authorization.
The object identifier may be predictable or random; the actual failure is missing object-level authorization. Every read and write should test the caller's relationship to that specific record.
Examples in practice
A user replaces their invoice ID with another customer's ID and receives that customer's invoice because ownership is never checked.
A customer guesses another invoice number, but the server compares invoice ownership with the signed-in account and returns a denial. A regression test covers both read and update endpoints.
Why it matters
IDOR can expose or change individual records across customer or tenant boundaries.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.