Weaknesses of type CWE-639

2,490 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2023-1417MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.1EPSS 0.7%CVE-2023-6724HIGHIDOR in Simgesel Software's Hearing Tracking System (Barosel)EPSS 0.7%CVE-2026-88877CRITICALTraefik v3.7.0 Authentication Bypass via from-to-www-redirectEPSS 0.6%CVE-2026-55178HIGHGeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile dataEPSS 0.6%CVE-2025-34140HIGHETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI SuffixEPSS 0.6%CVE-2023-37871HIGHWordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)EPSS 0.6%CVE-2024-1313MEDIUMUsers outside an organization can delete a snapshot with its keyEPSS 0.6%CVE-2023-0550HIGHQuick Restaurant Menu <= 2.0.2 - Insecure Direct Object ReferenceEPSS 0.6%CVE-2026-53729HIGHDataEase ExportCenter IDOR allows cross-user export task accessEPSS 0.6%CVE-2026-59236MEDIUMAuthorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injectionEPSS 0.6%CVE-2026-59234MEDIUMAuthorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletionEPSS 0.6%CVE-2022-3331LOWAn issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15EPSS 0.6%CVE-2026-59237MEDIUMIDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of ordersEPSS 0.6%CVE-2023-24834MEDIUMWisdomGarden Tronclass ilearn - Broken Access ControlEPSS 0.6%CVE-2024-45614MEDIUMHeader normalization allows for client to clobber proxy set headers in PumaEPSS 0.6%CVE-2022-3794MEDIUMJeg Elementor Kit <= 2.5.6 - Authorization BypassEPSS 0.6%CVE-2026-39386HIGHNeko has Self-service Privilege Escalation for Authenticated UsersEPSS 0.6%CVE-2022-42129MEDIUMAn Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and LifEPSS 0.6%CVE-2025-24315MEDIUMGrowatt Cloud portal Authorization Bypass Through User-Controlled KeyEPSS 0.6%CVE-2026-62666HIGHGrav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of superEPSS 0.6%