/hunt-idor

name: hunt-idor
description: Hunting skill for Insecure Direct Object Reference / Broken Object Level Authorization (BOLA — OWASP API1:2023). Built from 1,117 public IDOR bug bounty reports across HackerOne, Bugcrowd, Intigriti, GitHub Security Advisories, Huntr, plus 2024-2026 meta verified against NVD — Sam Curry's automotive chain (Kia/Hyundai/Ferrari), CVE-2026-30956 (OneUptime tenant header bypass CVSS 9.9), CVE-2025-64431 (Zitadel V2Beta Org API), CVE-2026-32131 (Zitadel Management API), CVE-2025-61876 (Inforcer tenant enumeration), CVE-2024-45719 (Apache Answer UUIDv1 token prediction), CVE-2024-50633 (Indico BOLA), plus the GraphQL field-level / nested-object pivot wave and agentic AI cross-tenant family (FastGPT, WeKnora, Paperclip). Use when hunting IDOR / BOLA / cross-tenant data access on web apps, APIs, GraphQL endpoints, multi-tenant SaaS, mobile apps, automotive/IoT platforms, and AI/ML inference servers.
sources: hackerone_public, github_advisories, github_deep, intigriti, huntr, project_zero, microsoft_msrc, bugcrowd, code4rena, immunefi, securitylab_github, nvd_verified
report_count: 1117
generated_at: 2026-05-04

Crown Jewel Targets

IDOR (renamed BOLA in OWASP API1:2023) is the highest-frequency, second-highest-value bug class in modern bug bounty after RCE. ~40% of API attacks observed across production environments are BOLA per published research (Snyk 2026 Feb analysis). The 24-month meta has shifted decisively toward six asset types. All CVEs below are NVD-verified.

**1. Multi-tenant SaaS with client-supplied tenant context (CVSS 9.9 territory).** Every "send the tenant_id in the request" architecture is a candidate. **CVE-2026-30956** (OneUptime — `is-multi-tenant-query` header bypass + `projectid` header override → cross-tenant data exposure → reset token leak → ATO; GHSA-r5v6-2599-9g3m, CVSS 9.9 critical) is the canonical 2026 example. **CVE-2026-32131** (Zitadel Management API — low-priv `project.read` token reads other tenant's OIDC config; GHSA-wr6r-59xg-4pj2, affects 4.x through 4.12.1, 3.x through 3.4.7, 2.x through 2.71.19). **CVE-2025-64431** (Zitadel V2Beta Organization API — admin in Org A reads/modifies/deletes Org B; GHSA-cpf4-pmr4-w6cx, CVSS 8.7, fix in 4.6.3). Hunt header tenant injection on every multi-tenant target: `Tenantid`, `X-Org-Id`, `X-Tenant-ID`, `X-Project-Id`, `environmentId`, `is-multi-tenant-query`, `channel`. The OnSecurity disclosure ("How a single HTTP header unlocked every customer's data") documents the pattern in textbook form — `Tenantid: 3` to `Tenantid: 2` with no other change.

**2. Automotive / connected-vehicle platforms (six-figure-impact territory).** Sam Curry's pattern. **Kia 2024 disclosure** (samcurry.net/hacking-kia, Sep 2024) — dealer portal channel header manipulation → cross-account access → vehicle PII (name, phone, email, address) → silent secondary-user addition → remote unlock/start/track on any post-2013 Kia by license plate alone in 30 seconds. **Hyundai/Genesis/Honda/Nissan/Infiniti/Acura 2022-2023** (samcurry.net/web-hackers-vs-the-auto-industry) — same chain class against the entire auto industry. **Ferrari 2023** — full ATO + admin CMS access via IDOR on customer records + back-office endpoints. Hunt: dealer portals, fleet management APIs, telematics endpoints, OTA update orchestrators, EV charging networks. Bounties paid through automaker private programs and HackerOne IBB; impact framing pays mid-to-high five-figure when chained to physical vehicle control.

**3. GraphQL field-level / nested-object pivot (low-to-mid five-figure on enterprise SaaS).** GraphQL's resolver model means every field needs its own auth check, and most schemas miss them. **HackerOne $12,500 bounty Dec 2025** (Harshdranjan, documented by Monika Sharma writeup) — `certificationId` change in mutation deletes other users' Licenses & Certifications on hackerone.com itself. **$1,500 GraphQL field-level Feb 2026** (tinopreter Medium writeup) — `GetOrgWebhooks` query returns webhooks the user shouldn't see because field-level perms missing on `Project` accessed via `Organization` parent. **Yasser Hamoda April 2025 writeup** — unauthenticated GraphQL `user(username:"victim")` returns admin email/role with no auth. The pattern: any GraphQL endpoint where authentication is checked but field-level/object-level authorization isn't. Pivot endpoints: `me`, `user`, `organization`, `project`, `workflow`, `team`. Mutation IDOR (delete/update by ID) pays more than query IDOR.

**4. AI/ML platforms with cross-tenant model/data access.** New 2025-2026 surface, well-paying. **GHSA-3xx2-mqjm-hg9x (Paperclip Apr 2026, CVSS 10.0)** — board user in Company A mints agent API keys for any agent in Company B via `/agents/:id/keys`, then operates as that agent inside victim tenant — full cross-tenant compromise. **GHSA-gc8m-w37w-24hw (FastGPT)** — authenticated team accesses and executes any `appId` on `/api/v1/chat/completions` regardless of team ownership. **GHSA-2f4c-vrjq-rcgv (Tencent WeKnora)** — missing `tenant_id` WHERE clause in DB query tool exposes all tenants' API keys, model configs, private messages cross-tenant. The pattern: AI inference / agent management endpoints checking authentication but skipping tenant scoping.

**5. Government & enterprise legacy assets (DoD VDP through low five-figure on paid programs).** The H1 2024-2026 hacktivity is full of "IDOR exposes PII of tens of thousands" reports against forgotten asset surfaces. The 2026 Air Force candidate PII + recruitment chat logs disclosure (H1 critical) is a textbook example. Hunt: legacy CMS, candidate/recruitment portals, support ticket systems, file-upload migration endpoints, document-share systems.

**6. Apache Answer / Q&A / forum platforms with predictable token surface.** **CVE-2024-45719** (Apache Answer through 1.4.0, GHSA-mr95-vfcf-fx9p) — UUIDv1 timestamp-based tokens predict-by-arithmetic. The bananabr GitHub Security Lab disclosure (issue #816, paid via Hac