Weaknesses of type CWE-639

1,841 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-31874CRITICALTaskosaur Improper Role Assignment via Parameter Manipulation in User RegistrationEPSS 0.6%CVE-2024-10174HIGHWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization BypassEPSS 0.6%CVE-2023-53914CRITICALUliCMS 2023.1 Authentication Bypass via Mass Assignment VulnerabilityEPSS 0.6%CVE-2026-5465HIGHAmelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' ParameterEPSS 0.6%CVE-2026-1992HIGHExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin InstallationEPSS 0.6%CVE-2022-2198—WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOREPSS 0.6%CVE-2025-45968CRITICALAn issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL. The application contaiEPSS 0.6%CVE-2026-38529HIGHA Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attEPSS 0.6%CVE-2024-2472CRITICALLatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOREPSS 0.6%CVE-2024-2543MEDIUMPlugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editorEPSS 0.6%CVE-2026-5246MEDIUMCesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorizationEPSS 0.6%CVE-2024-40395MEDIUMAn Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardlessEPSS 0.6%CVE-2022-2824HIGHAuthorization Bypass Through User-Controlled Key in openemr/openemrEPSS 0.6%CVE-2018-17455HIGHAn issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sEPSS 0.6%CVE-2024-0839MEDIUMFeedWordPress <= 2022.0222 - Insecure Direct Object RefereceEPSS 0.6%CVE-2024-33818HIGHGlobitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference (IDOR) via the userID parameter.EPSS 0.6%CVE-2023-44154MEDIUMSensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect EPSS 0.6%CVE-2023-4213HIGHSimplr Registration Form Plus+ <= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 0.6%CVE-2026-34444HIGHLupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattrEPSS 0.6%CVE-2022-44005MEDIUMAn issue was discovered in BACKCLICK Professional 5.9.63. Due to the use of consecutive IDs in verification links, the newsletter sign-up fuEPSS 0.6%