Skip to main content
Allowing access to internal objects/resources based on user-supplied identifiers without proper authorization checks.

​
How to resolve

Verify ownership: Before accessing a resource, verify that the authenticated user owns the resource or has explicit permission to access it. Use indirect references: Replace direct object IDs with session-specific indirect references or tokens that map to actual resources server-side. Implement access control checks: Apply consistent authorization checks across all MCP tool implementations that access user data. Avoid exposing internal IDs: Use non-guessable resource identifiers (UUIDs) instead of sequential integers to make enumeration attacks more difficult.

​
Risk

Governance/Compliance Insecure Direct Object Reference vulnerabilities violate multiple security standards:
  • OWASP Top 10 2025 (A01:2025 - Broken Access Control): Fails to verify user authorization before granting access to resources.
  • CWE-639 (Authorization Bypass Through User-Controlled Key): Allows access to resources by manipulating references without proper authorization checks.
  • NIST SP 800-53 (AC-3): Does not enforce access control policies based on user identity and permissions.
  • OWASP MCP Top 10 (MCP07:2025 - Insufficient Authentication & Authorization): Lack of authorization checks on resource identifiers enables unauthorized access through MCP tools.
Security An attacker can access or modify data belonging to other users by manipulating resource identifiers in MCP tool parameters. This can lead to unauthorized data disclosure, data tampering, or privacy violations. The severity depends on the sensitivity of accessible resources, but IDOR vulnerabilities commonly enable horizontal privilege escalation where users can access peers’ data.

​
Explanation

Insecure Direct Object References (IDOR) occur when MCP tools expose access to internal objects or resources based on user-supplied identifiers without verifying that the authenticated user is authorized to access them. The scanner identifies direct resource access patterns that lack authorization checks. This can be prevented by validating that the authenticated user owns or has permission to access the requested resource before performing operations.

​
Specifications

Trigger
  • MCP server scan detects direct access to resources using user-supplied identifiers without authorization verification
Severity
  • LOW
Applies to: MCP Server