Weaknesses of type CWE-639

2,500 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-23522LOWLobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File DeletionEPSS 0.2%CVE-2026-16574MEDIUMDokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST EndpointEPSS 0.2%CVE-2026-77517MEDIUMMaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge baseEPSS 0.2%CVE-2026-27898MEDIUMVaultwarden: Unauthorized Access via Partial Update API on Another User’s CipherEPSS 0.2%CVE-2026-14184MEDIUMAcademy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOREPSS 0.2%CVE-2026-14224MEDIUMEasy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOREPSS 0.2%CVE-2026-52839LOWEasy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization BypassEPSS 0.2%CVE-2026-93623MEDIUMWordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.2%CVE-2026-100579HIGHOpenClaw before 2026.7.1 Authentication Bypass via Spoofed RequesterEPSS 0.2%CVE-2026-2257MEDIUMGetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST APIEPSS 0.2%CVE-2026-40865HIGHHorilla: Insecure Direct Object Reference at `/employee/view-file/<int:id>EPSS 0.2%CVE-2025-13874MEDIUMAuthorization Bypass Through User-Controlled Key in GitLabEPSS 0.2%CVE-2026-68493LOWAfter guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they arEPSS 0.2%CVE-2026-96271HIGHPhotoview through 2.4.0 Authorization Bypass via shareAlbumEPSS 0.2%CVE-2025-14101HIGHIDOR in GG Soft's PaperWorkEPSS 0.2%CVE-2025-14742MEDIUMWP Recipe Maker <= 10.2.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information ExposureEPSS 0.2%CVE-2025-68492LOWChainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploitEPSS 0.2%CVE-2025-12833MEDIUMGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image AttachmentEPSS 0.2%CVE-2025-13382MEDIUMFrontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File RenamingEPSS 0.2%CVE-2026-14326LOWTimetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOREPSS 0.2%