Weaknesses of type CWE-639

2,497 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-95602MEDIUMWordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-72680MEDIUMAuthorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data ModificationEPSS 0.3%CVE-2026-22383HIGHWordPress PawFriends - Pet Shop and Veterinary WordPress theme theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2025-1284MEDIUMWoocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information DisclosureEPSS 0.3%CVE-2025-7347HIGHIDOR in Dinibh Puzzle's Dinibh Patrol Tracking SystemEPSS 0.3%CVE-2026-35165MEDIUMLORIS has incorrect access checks in document_repositoryEPSS 0.3%CVE-2026-100610HIGHFlowise through 3.1.4 Missing Authorization via upsert-historyEPSS 0.3%CVE-2025-43803MEDIUMInsecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsEPSS 0.3%CVE-2025-10719MEDIUMWisdomGarden｜Tronclass - Insecure Direct Object ReferenceEPSS 0.3%CVE-2026-34985MEDIUMLORIS has incorrect access checks in media moduleEPSS 0.3%CVE-2025-64011MEDIUMNextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user caEPSS 0.3%CVE-2026-85009MEDIUMRestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment RecoveryEPSS 0.3%CVE-2026-42862HIGHFlowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource ReassignmentEPSS 0.3%CVE-2024-5258MEDIUMAuthorization Bypass Through User-Controlled Key in GitLabEPSS 0.3%CVE-2025-68502MEDIUMWordPress JetPopup plugin <= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-56724HIGHZammad: Incorrect implementation of permission checks in the knowledge base moduleEPSS 0.3%CVE-2026-30825NONEhoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access TokenEPSS 0.3%CVE-2026-81182MEDIUMSysReptor: Unauthorized file disclosure by broken access control in writable shared notesEPSS 0.3%CVE-2025-11895MEDIUMBinary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object ReferenceEPSS 0.3%CVE-2026-40784HIGHWordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%