Weaknesses of type CWE-639

2,495 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-59253MEDIUMn8n - Improper Authorization in Workflow Assignment to FoldersEPSS 0.3%CVE-2026-101084CRITICALobot before v0.21.1 Authorization Bypass via /mcp-connectEPSS 0.3%CVE-2026-5006MEDIUMVault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy PathsEPSS 0.3%CVE-2025-64497MEDIUMTuleap exposes releases for all projects to File Release System project administratorsEPSS 0.3%CVE-2025-66547MEDIUMNextcloud Server users can modify tags on files that do not belong to themEPSS 0.3%CVE-2026-72547HIGHAttendize Attendize - Insecure Direct Object ReferenceEPSS 0.3%CVE-2026-72546HIGHAttendize Attendize - Insecure Direct Object ReferenceEPSS 0.3%CVE-2025-66558LOWNextcloud Twofactor WebAuthn app was updated based on public keyEPSS 0.3%CVE-2026-47130HIGHNextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data TamperingEPSS 0.3%CVE-2025-3282MEDIUMUser Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership ModificationEPSS 0.3%CVE-2026-28747HIGHMilesight Cameras Authorization Bypass Through User-Controlled KeyEPSS 0.3%CVE-2026-82968MEDIUMKeycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providersEPSS 0.3%CVE-2026-95602MEDIUMWordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2025-12427MEDIUMYITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist RenameEPSS 0.3%CVE-2025-7347HIGHIDOR in Dinibh Puzzle's Dinibh Patrol Tracking SystemEPSS 0.3%CVE-2026-72680MEDIUMAuthorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data ModificationEPSS 0.3%CVE-2025-66553MEDIUMNextcloud Tables app allowed users to view columns metadata information of any tableEPSS 0.3%CVE-2025-1284MEDIUMWoocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information DisclosureEPSS 0.3%CVE-2024-6357MEDIUMInsecure Direct Object Reference vulnerabilityEPSS 0.3%CVE-2026-44732MEDIUMOpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of ResourcesEPSS 0.3%