Weaknesses of type CWE-639

2,497 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2024-42169HIGHHCL MyXalytics is affected by insecure direct object referencesEPSS 0.3%CVE-2026-81182MEDIUMSysReptor: Unauthorized file disclosure by broken access control in writable shared notesEPSS 0.3%CVE-2026-79759MEDIUMTermix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host EndpointEPSS 0.3%CVE-2026-12102LOWUsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' ParameterEPSS 0.3%CVE-2025-15147MEDIUMWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership PaymentEPSS 0.3%CVE-2026-86763MEDIUMsnipe-it 7.0.12 through 8.6.3 Authorization Bypass via ImporterEPSS 0.3%CVE-2026-16953MEDIUMAI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session CookieEPSS 0.3%CVE-2026-81916MEDIUMIncorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized ObjectEPSS 0.3%CVE-2025-69274LOWSpectrum broken authorization schemeEPSS 0.3%CVE-2026-32535MEDIUMWordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2024-31898MEDIUMIBM InfoSphere Information Server data modificationEPSS 0.3%CVE-2026-84720MEDIUMAutomation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracleEPSS 0.3%CVE-2025-43810MEDIUMInsecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2EPSS 0.3%CVE-2026-47388LOWNocoDB: Missing Ownership Check in MCP Attachment ReadEPSS 0.3%CVE-2026-67403CRITICALCash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks EPSS 0.3%CVE-2026-13350LOWPermissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.EPSS 0.3%CVE-2026-28361MEDIUMNocoDB: Missing Ownership Validation in MCP Token OperationsEPSS 0.3%CVE-2026-81194MEDIUMMasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id ParameterEPSS 0.3%CVE-2026-77116MEDIUMBrave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via PreviewEPSS 0.3%CVE-2026-14183MEDIUMClassified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOREPSS 0.3%