CVE-2026-51367: Insecure Direct Object Reference (IDOR) Leading to Unauthorized Data Access

Summary

Affected Components

The vulnerability affects multiple API endpoints where user-controlled identifiers are used to retrieve private user-specific resources without enforcing proper server-side authorization checks.

Affected endpoints:

• POST /api_vedo/dati-ftp?utente_ftp=username

• GET /api_vedo/chat?utente_chat=username

The parameters utente_ftp and utente_chat are accepted from the client and used to reference user-specific resources. However, the application does not properly verify that the authenticated user is authorized to access the requested object.

Vulnerability Description

An authenticated low-privileged user can modify the utente_ftp or utente_chat parameter to reference another valid user identifier. Due to missing object-level authorization controls, the application returns information belonging to other users.

This is a classic case of Insecure Direct Object Reference (IDOR), where internal object identifiers are exposed through user-controlled parameters and access control is not enforced server-side.

Exploitation Characteristics

Exploitation requires:

• A valid authenticated account with low privileges.

• Knowledge or enumeration of another valid username identifier.

• Modification of the affected parameter within an HTTP request.

No user interaction is required.

Example exploitation scenarios:

• POST /api_vedo/dati-ftp?utente_ftp=

• GET /api_vedo/chat?utente_chat=

By replacing the identifier with another user’s value, an attacker may retrieve resources associated with that account.

Impact

Successful exploitation allows an authenticated attacker to:

• Access private chat communications belonging to other users.

• Retrieve unauthorized FTP-related user information.

• Violate confidentiality of user-specific application data.

The vulnerability has a high confidentiality impact because private communications and user-specific resources can be accessed without authorization.

CWE Mapping

• CWE-639 — Authorization Bypass Through User-Controlled Key

• CWE-284 — Improper Access Control

• OWASP API Security Top 10: API1: Broken Object Level Authorization (BOLA)

Root Cause

The root cause is the absence of server-side authorization checks before returning user-specific resources.

The application trusts client-provided identifiers (utente_ftp and utente_chat) and does not verify that the authenticated account owns or is allowed to access the requested object.

Mitigation and Remediation

• Deploy a Web Application Firewall (WAF) with SQL injection detection rules as an interim compensating control until a code-level fix is available and applied.

• Apply vendor patches as soon as they are released, and track the vendor’s advisory for confirmation of the fixed version.

In general, to prevent these types of vulnerabilities, developers should:

• Implement server-side authorization checks for every object request.

• Associate requested resources with the authenticated session identity rather than trusting client-supplied identifiers.

• Apply object-level access control policies to all API endpoints.

• Avoid exposing predictable user identifiers where possible.

• Perform a complete audit of API endpoints accepting user-controlled object references.

• Add authorization testing to security regression testing procedures.

Evidence Handling

Screenshots demonstrating unauthorized access are intentionally omitted from this advisory because the affected information contains restricted user data and private communications.

The vulnerability was validated through controlled testing by modifying the affected parameters and confirming unauthorized access behavior.

References

• CWE-639 — Authorization Bypass Through User-Controlled Key
  https://cwe.mitre.org/data/definitions/639.html
  :contentReferenceoaicite:1

• CWE-284 — Improper Access Control
  https://cwe.mitre.org/data/definitions/284.html
  :contentReferenceoaicite:2

• OWASP API Security Top 10 — API1: Broken Object Level Authorization (BOLA)

  • API1:2023 — Broken Object Level Authorization
    https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/

  • API1:2019 — Broken Object Level Authorization
    https://owasp.org/API-Security/editions/2019/en/0xa1-broken-object-level-authorization/
    :contentReferenceoaicite:3

  Credits

  Andrea Ferrario, Stefano Andreatta, CybergON