Weaknesses of type CWE-639

1,841 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2025-6329MEDIUMScriptAndTools Real Estate Management System User Delete userdelete.php authorizationEPSS 0.4%CVE-2026-7648MEDIUMLearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' ParameterEPSS 0.4%CVE-2025-26965MEDIUMWordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2026-46544MEDIUMMicrosoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requestersEPSS 0.4%CVE-2026-59733HIGHrclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositoriesEPSS 0.4%CVE-2026-33511HIGHpyload-ng: Authentication Bypass via Host Header Injection in ClickNLoadEPSS 0.4%CVE-2025-64523HIGHFileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion FunctionEPSS 0.4%CVE-2024-1693MEDIUMSP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name UpdateEPSS 0.4%CVE-2024-13372MEDIUMWP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume DownloadEPSS 0.4%CVE-2025-28874MEDIUMWordPress BP Email Assign Templates By shanebp plugin <= 1.7 - Arbitrary Content Deletion vulnerabilityEPSS 0.4%CVE-2025-14844HIGHMembership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information ExposureEPSS 0.4%CVE-2024-4279MEDIUMTutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course DeletionEPSS 0.4%CVE-2025-58627CRITICALWordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2026-33345MEDIUMsolidtime vulnerable to IDOR in private projectsEPSS 0.4%CVE-2022-36966MEDIUMInsecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6EPSS 0.4%CVE-2026-20897CRITICALGitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)EPSS 0.4%CVE-2026-20912CRITICALGitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment DisclosureEPSS 0.4%CVE-2023-38049CRITICALA BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2024-12046MEDIUMMedical Addon for Elementor <= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via ShortcodeEPSS 0.4%CVE-2026-59235HIGHMissing authorization in Prospero Flow CRM allows low-privileged users to read all bank accountsEPSS 0.4%