IDOR occurs when applications use user-controllable identifiers to access objects without proper authorization checks, allowing access to other users' data.
Scan for This VulnerabilityWhen an application uses a user-supplied ID (like in /api/documents/123) without verifying the requesting user is authorized to access that specific resource, attackers can iterate through IDs to access other users' data. This is one of the most common authorization flaws.
Access to other users' private data
Modification of others' resources
Privacy violations
Data theft at scale
Always check if the requesting user owns or can access the resource.
// Supabase RLS handles this automatically
CREATE POLICY "Users access own docs" ON documents
FOR ALL TO authenticated
USING ((select auth.uid()) = user_id);Explicitly verify authorization on every request.
// API route
const doc = await db.document.findFirst({
where: {
id: documentId,
userId: currentUser.id // Authorization check
}
});
if (!doc) {
return res.status(404).json({ error: 'Not found' });
}Let the database enforce authorization.
VAS automatically scans for insecure direct object reference (idor) and provides detailed remediation guidance.
Run Security Scan