Bug #22305
[External Audit Findings][MLEB] Insecure Direct Object Reference Vulnerability (IDOR)
| Status: | New | Start date: | 29 July 2025 | |
|---|---|---|---|---|
| Priority: | High | Due date: | ||
| Assignee: | Tan Hi Ann | % Done: | 0% | |
| Category: | - | Spent time: | - | |
| Target version: | - |
Description
Issue:
The IDOR vulnerability occurs when an app exposes internal object references without access control. This allows attackers to access data by manipulating input values. If exploited, IDOR may lead to serious business data breaches.
Recommendation from pentester:
Developers must implement proper access control so that users can only access information or perform actions within a session that are defined by the access rights assigned to that session.
Please refer to attached excel for details.