Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Route-bound model is updated directly from generic Request input without explicit authorization or FormRequest validation, potentially allowing IDOR or unauthorized modifications.
Potential missing object-level authorization check. Sensitive operations on resources identified by user-controlled IDs should verify that the current subject has appropriate read/manage permissions.
Organization-scoped route is protected by JwtAuthGuard but lacks OrganizationValidateGuard, allowing authenticated cross-tenant access to organization resources.
Media entity collection reassignment performed without verifying permissions on the source and destination collections using SecurityChecker. An authenticated user could move items out of restricted collections to access unauthorized media.
Route handler parameter `$AUTH` is obtained via `Depends(...)` but is never referenced in the handler body when accessing conversation management services. This indicates a broken object-level authorization (BOLA/IDOR) vulnerability where conversation operations are performed without user ownership validation.
The Resource endpoint fetches user-specific data using a 'user_id' parameter with only basic API authentication ('api_required') and no administrator or role-based access control decorator, potentially exposing sensitive data to IDOR/broken access control.
REST endpoint performs entity removal or retrieval without verifying that the target entity's realm is accessible to the authenticated context.
Report template selection or default template configuration does not validate client ownership, potentially allowing cross-client template access or assigning client-scoped templates globally.
Chaining `where()` conditions directly with `orWhere()` at the top query level causes logical operator precedence issues (`WHERE A AND B OR C` evaluates to `(A AND B) OR C`), which can bypass preceding tenant or authorization filters. Group OR conditions inside a `where(function ($query) { ... })` closure instead.
ManagedCluster deletion is performed based on target namespace without validating ClusterDeployment ownership via ClusterPoolRef against the ClusterClaim.
The JWT 'sub' (subject) claim is assigned a hardcoded string literal instead of a user-specific identifier. JWT subject claims must uniquely identify the authenticated user or principal to prevent token confusion and authorization bypasses.
Access token or session verification does not confirm that the token belongs to the target resource. An attacker with a valid token for one resource may gain unauthorized access to another resource.
Missing authorization check for referenced replacement certificates in certificate creation, upload, or modification endpoints.
User-supplied array parameters from req.body are passed directly into event emissions or scope operations without prior database querying and filtering to ensure ownership within the target scope.
OutLink management operation is authorized using only public shareId or authOutLinkValid instead of verifying authenticated user identity and manage permissions via authOutLinkCrud.
Direct lookup of an entity by a user-supplied ID without authorization checks can lead to Insecure Direct Object Reference (IDOR). Attackers can iterate through sequential IDs to access unauthorized data. Ensure proper access controls are in place, use unguessable tokens for sensitive resource lookups, or enforce authorization checks verifying that the curre
Directly using user input to query entities by a predictable 'id' primary key bypasses token-based authorization and can lead to Insecure Direct Object Reference (IDOR) vulnerabilities. Use unpredictable secure tokens (e.g., `findOneByTokenValue`) rather than predictable integer IDs, or ensure the endpoint explicitly validates the user's access to the refere
Duplicate form uses a hidden ModelChoiceField with unrestricted queryset without validating user permissions on the source object in clean_source(), allowing unauthorized object duplication.
Stream identifier retrieved from request parameters is accessed via GetStream without validating user ownership or authorization via IsStreamAuthorizedForUser.
Detected a TypeORM query using an OR condition (array in `where` clause or `.orWhere()`) where one branch filters by a generic property while another branch filters by a user identifier. This can cause an Insecure Direct Object Reference (IDOR) or authorization bypass if the generic property was intended to be restricted to the user. The OR condition broaden
Chaining `orWhere` directly after multiple `where` clauses without grouping inside a closure causes SQL `OR` operator precedence to bypass preceding `AND` filters (such as tenant or access control checks). Wrap the disjunctive conditions inside a nested closure: `where(function ($query) { $query->where(...)->orWhere(...); })`.
Chaining `orWhere` directly after `where` scoping conditions without grouping them in a closure can bypass multi-tenant or authorization scoping due to SQL operator precedence (AND evaluated before OR). Group OR conditions using `where(function ($query) { $query->where(...)->orWhere(...); })`.
Ungrouped `orWhere` clause chained on an Eloquent query builder can bypass prior `where` constraints (such as tenant or authorization filters) due to SQL operator precedence. Group logical OR conditions inside a closure passed to `where` or `orWhere` (e.g., `where(function($query) { ... })`).
A TypeORM query uses an array for the 'where' option or a Brackets query builder translating to a logical OR in SQL. One of the conditions introduces a user/tenant scoping variable (e.g., userId), while the other lacks it. This permits authorization bypass (IDOR) where an attacker can access globally scoped records if they satisfy the unscoped condition. Ens
