Datadog tests security rules on coding agents' secure code
Without rules, Sonnet 5, Composer 2.5, and GPT 5.5 all left IDOR flaws in a document portal.
1
Stories per day · 30 days
4 RSS
Relatedauthentication-bypass1bisheng1cert1claude1coding-agents1cursor1dataelement1jwt1llm1project-codeguard1secure-coding1
16 stories, newest first · one card per story
Stories tagged #idor
VU#166125: Bisheng has authentication bypass vulnerabilities
CERT/CC warns Bisheng has an unpatched SSO authentication bypass that can grant super-admin access.
5
[OSSN-0109] Cross-project metric association bypass in Gnocchi
OpenStack Gnocchi lets authenticated users attach metrics to other projects' resources, bypassing authorization checks.
Hackers Use ERP Web Shell and IDOR Flaws to Breach Major South Korean Churches
Attackers breached two major South Korean churches with ERP web shells and IDOR flaws, exposing hundreds of thousands of records.
4
Edgescan Atomic validates attack paths with controlled AI testing
Edgescan launched Atomic, an agentic-AI penetration-testing product that validates attack paths under a control harness.
2
[webapps] Krayin CRM 2.2.4 - IDOR
Exploit-DB published an IDOR exploit for Krayin CRM 2.2.4.
CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups
Apache Roller 6.1.5 lets one weblog's authors tamper with another weblog's resources.
VU#754548: Cinnamon's kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers
Kotaemon through v0.12.0 lets any logged-in user read or alter others' chats and document excerpts via CVE-2026-86867.
Siemba brings continuous IDOR testing to production APIs
Siemba released automated IDOR/BOLA testing for REST, GraphQL and SOAP APIs, checking a 200-endpoint collection in under an hour.
2
IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications
IDORacle intercepts MyBatis/JDBC SQL sinks to block horizontal privilege escalation in legacy Java apps with sub-millisecond guard latency.
Condé Nast Data of 32.8 Million Users Offered for Sale After WIRED Leak
A 32.8 million-record Conde Nast user database is offered for $15,000 on a Russian cybercrime forum, extending December's WIRED leak with millions of unseen records.
1
Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests
Aikido replicated a gym-booking incident, showing Claude Opus 4.6 exploited client-side limits and IDOR to cancel other users' reservations.
2
AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments
Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.
1
Identifying a BOLA Vulnerability in Harbor, a Cloud
Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.
Harnessing LLMs for Automating BOLA Detection
Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.
1
[webapps] Probo 0.222.2 - IDOR
A public proof-of-concept exploit was released for an IDOR vulnerability in web application Probo 0.222.2.