IDOR in a web app review: the finding buyers actually mean
When buyers say IDOR they mean object access that ignores whose record it is. That check belongs in an authorized web app review.
Buyers say IDOR when they mean: can support user 18 open invoice 19?
That question is ordinary. It is also how tenants leak.
Short answer: Object-access checks are part of the authorized web application security review. $2,400 per app, $1,200 to start. The report ranks the finding. It does not teach a stranger how to replay it.
How I talk about it in the PDF
Identifier, severity, which role, which object type, what should have been checked, how to fix it. Evidence is redacted. The sample pentest report shows the bar style.
I will not publish a recipe. I will not test a tenant you do not own.
What else sits next to IDOR
Missing auth on the same endpoint. Exports that ignore role. Downloads that trust a guessed filename.
Offer and payment: security review, pricing.
FAQ
What is IDOR in a web app? +
Insecure direct object reference: a user can open another user's record by changing an id. In a review I check whether the API honors ownership.
Is IDOR in scope of the $2,400 review? +
Yes, on the application you authorize — the objects the UI already touches and the obvious neighbors.
Will the report include a working exploit? +
No. It will name the path, the severity, and the fix. No payload cookbook.
