Weaknesses of type CWE-639

2,500 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2025-11518MEDIUMWPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist ManipulationEPSS 0.2%CVE-2025-3853MEDIUMWPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key GenerationEPSS 0.2%CVE-2026-1883MEDIUMWicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder DeletionEPSS 0.2%CVE-2026-100609HIGHFlowise through 3.1.4 Insecure Direct Object Reference via CredentialEPSS 0.2%CVE-2026-14823LOWEvent Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOREPSS 0.2%CVE-2026-84225LOWKirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOREPSS 0.2%CVE-2026-12510MEDIUMAI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOREPSS 0.2%CVE-2026-47716LOWBugsink: Issue bulk actions can affect another project’s issue if its UUID is knownEPSS 0.2%CVE-2023-32352—A logic issue was addressed with improved checks. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS MonterEPSS 0.2%CVE-2025-64067MEDIUMPrimakon Pi Portal 1.0.18 API endpoints responsible for retrieving object-specific or filtered data (e.g., user profiles, project records) fEPSS 0.2%CVE-2026-33141MEDIUMChamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning DataEPSS 0.2%CVE-2026-15238MEDIUMHotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOREPSS 0.2%CVE-2026-14184MEDIUMAcademy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOREPSS 0.2%CVE-2026-16574MEDIUMDokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST EndpointEPSS 0.2%CVE-2026-77425MEDIUMUnleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit logEPSS 0.2%CVE-2026-77517MEDIUMMaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge baseEPSS 0.2%CVE-2026-27898MEDIUMVaultwarden: Unauthorized Access via Partial Update API on Another User’s CipherEPSS 0.2%CVE-2026-14224MEDIUMEasy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOREPSS 0.2%CVE-2026-14310MEDIUMTutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply InjectionEPSS 0.2%CVE-2026-8155MEDIUMBuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOREPSS 0.2%