Daeungdaeung

**Name of the Vulnerable Software and Affected Versions** AutoGPT (affected versions not specified) **Description** An Insecure Direct Object Reference (IDOR) exists in the `POST /api/integrations/webhooks/{webhook id}/ping` endpoint. The system retrieves the target webhook using only the primary key without verifying ownership by the authenticated user. This allows an authenticated user to provide an arbitrary `webhook id` to confirm if a webhook exists, leak the OAuth provider type, and potentially trigger a ping delivery on behalf of another user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.