Weaknesses of type CWE-639

2,514 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-88912MEDIUMrtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOREPSS 0.2%CVE-2025-12086MEDIUMReturn Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request CancellationEPSS 0.2%CVE-2026-81653MEDIUMNextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOREPSS 0.2%CVE-2025-12063MEDIUMAn insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissEPSS 0.2%CVE-2026-93513MEDIUMWordPress SiteSkite plugin <= 2.1.7 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.2%CVE-2025-12997LOWInsecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific EPSS 0.2%CVE-2026-23638MEDIUMKiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled KeyEPSS 0.2%CVE-2026-86837MEDIUMBookly < 28.3 - Unauthenticated Customer PII Update via Verification BypassEPSS 0.2%CVE-2026-86867MEDIUMCinnamon's kotaemon contains improper authorization checks in multi‑user chat handlersEPSS 0.2%CVE-2025-53357MEDIUMGLPI permits reservation modification by unauthorized usersEPSS 0.2%CVE-2023-26237MEDIUMAn issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a registry key as SYSTEPSS 0.2%CVE-2026-61589MEDIUMdjust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live pathEPSS 0.2%CVE-2026-100626MEDIUMcapgo through 12.128.2 IDOR via PUT /app icon endpointEPSS 0.2%CVE-2026-73657MEDIUMTrigger.dev: Cross-tenant payload poisoning via packet write + replayEPSS 0.2%CVE-2026-24753MEDIUMKiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled KeyEPSS 0.2%CVE-2021-4142—The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use theEPSS 0.2%CVE-2025-8884MEDIUMIDOR in VHS Electronic Software's ACE CenterEPSS 0.2%CVE-2026-72662MEDIUMAuthorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of DataEPSS 0.2%CVE-2026-93538HIGHCross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in FleetEPSS 0.2%CVE-2025-14594LOWAuthorization Bypass Through User-Controlled Key in GitLabEPSS 0.2%