Weaknesses of type CWE-639

2,490 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-2346CRITICALIDOR in Menulux Software's Mobile AppEPSS 0.5%CVE-2024-9215HIGHCo-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account TakeoverEPSS 0.5%CVE-2026-18749CRITICALCVE-2026-18749EPSS 0.5%CVE-2026-61744MEDIUMInvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view roleEPSS 0.5%CVE-2026-13549MEDIUMCodeAstro Complaint Management System Report Endpoint Report.php deletereport authorizationEPSS 0.5%CVE-2026-82872HIGHToolJet before v3.16.208 Cross-Workspace Authorization BypassEPSS 0.5%CVE-2024-34383MEDIUMWordPress SEOPress plugin <= 7.7.1 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2026-78365CRITICALIDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modificationEPSS 0.5%CVE-2024-50693CRITICALSunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the userService APEPSS 0.5%CVE-2026-88065HIGH`tts-be` application has a Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-77759HIGHIDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial recordsEPSS 0.5%CVE-2024-5128CRITICALIDOR Vulnerability in lunary-ai/lunaryEPSS 0.5%CVE-2026-65316HIGHxxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCatEPSS 0.5%CVE-2026-7638MEDIUMApp Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' ParameterEPSS 0.5%CVE-2026-55429HIGHCoder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app IDEPSS 0.5%CVE-2020-37008HIGHEasyPMS 1.0.0 - Authentication BypassEPSS 0.5%CVE-2026-4958LOWOpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorizationEPSS 0.5%CVE-2026-91144HIGHZFile through 5.0.5 Share Entry Filter Bypass via Download EndpointEPSS 0.5%CVE-2026-47399HIGHPraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object IDEPSS 0.5%CVE-2026-61460HIGHKrayin CRM Insecure Direct Object Reference via ControllersEPSS 0.5%