Weaknesses of type CWE-639

1,841 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-54097HIGHFile Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefixEPSS 0.4%CVE-2024-44450MEDIUMMultiple functions are vulnerable to Authorization Bypass in AIMS eCrew. The issue was fixed in version JUN23 #190.EPSS 0.4%CVE-2024-33542MEDIUMWordPress Crelly Slider plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2024-5639MEDIUMUser Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture UpdateEPSS 0.4%CVE-2024-52507LOWShare information of the Nextcloud Tables app is not limited to affected usersEPSS 0.4%CVE-2024-9262MEDIUMUser Meta – User Profile Builder and User management plugin <= 3.1.1 - Insecure Direct Object Reference to Sensitive Information ExposureEPSS 0.4%CVE-2026-13450MEDIUMGamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' ParameterEPSS 0.4%CVE-2024-38447HIGHNATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report (that belongs toEPSS 0.4%CVE-2024-8261HIGHIDOR in Proliz Software's OBSEPSS 0.4%CVE-2024-32823MEDIUMWordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2026-5326MEDIUMSourceCodester Leave Application System User Information index.php authorizationEPSS 0.4%CVE-2024-13607MEDIUMJS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object ReferenceEPSS 0.4%CVE-2026-59234MEDIUMAuthorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletionEPSS 0.4%CVE-2026-9185HIGH6Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' ParameterEPSS 0.4%CVE-2024-11285CRITICALWP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account TakeoverEPSS 0.4%CVE-2025-49952MEDIUMWordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2023-30960MEDIUMInsecure Direct Object Reference (IDOR) in Foundry job-trackerEPSS 0.4%CVE-2023-3998MEDIUMwpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/DecreaseEPSS 0.4%CVE-2023-3869MEDIUMwpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/DecreaseEPSS 0.4%CVE-2023-38052CRITICALA BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0EPSS 0.4%