Weaknesses of type CWE-639

2,490 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2025-1607MEDIUMSourceCodester Best Employee Management System salary_slip.php authorizationEPSS 0.6%CVE-2026-28314CRITICALSolarWinds Serv-U Insecure Direct Object Reference (IDOR) VulnerabilityEPSS 0.6%CVE-2024-33818HIGHGlobitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference (IDOR) via the userID parameter.EPSS 0.6%CVE-2023-44154MEDIUMSensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect EPSS 0.6%CVE-2026-77776CRITICALHeadroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated IdentityEPSS 0.6%CVE-2026-44083HIGHQuMagieEPSS 0.6%CVE-2026-72543HIGHOpenSignLabs OpenSign - Insecure Direct Object ReferenceEPSS 0.6%CVE-2026-6072MEDIUMOliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' HeaderEPSS 0.6%CVE-2023-1889MEDIUMDirectorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_taskEPSS 0.6%CVE-2025-27507CRITICALIDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP ConfigurationsEPSS 0.6%CVE-2026-44400HIGHMailEnable Enterprise Premium < 10.55 Authorization Bypass via WebAdminEPSS 0.6%CVE-2026-9851HIGHBooking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX ActionEPSS 0.6%CVE-2026-41947CRITICALDify < 1.14.2 Authorization Bypass via Trace Configuration EndpointsEPSS 0.6%CVE-2026-7681MEDIUMjsbroks COCO Annotator Dataset API datasets.py authorizationEPSS 0.6%CVE-2023-48304MEDIUMNextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any userEPSS 0.6%CVE-2024-8290HIGHWCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege EscalationEPSS 0.6%CVE-2024-8292CRITICALWP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password UpdateEPSS 0.6%CVE-2026-56422CRITICALMISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request FieldsEPSS 0.6%CVE-2024-9862CRITICALMiniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password ChangeEPSS 0.6%CVE-2026-41471HIGHEasy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code EndpointEPSS 0.6%