Weaknesses of type CWE-639

2,490 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2024-50651MEDIUMjava_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs EPSS 0.5%CVE-2026-63763HIGHSurrealDB before 2.5.0 Privilege Escalation via Future FieldsEPSS 0.5%CVE-2026-73656CRITICALTrigger.dev: Cross-project deployment worker registration can modify another project's deployment stateEPSS 0.5%CVE-2026-47266HIGHFormie: Unauthenticated front-end submission editing can overwrite existing submissionsEPSS 0.5%CVE-2026-63647CRITICALCordysCRM SSE Notification Stream Hijack via `/sse/subscribe`EPSS 0.5%CVE-2024-0872MEDIUMWatu Quiz <= 3.4.1 - Sensitive Information DisclosureEPSS 0.5%CVE-2026-85105MEDIUMNousResearch hermes-agent Session Management s71.py _sess_nowait authorizationEPSS 0.5%CVE-2026-28317CRITICALSolarWinds Serv-U Insecure Direct Object Reference (IDOR) VulnerabilityEPSS 0.5%CVE-2026-28313CRITICALSolarWinds Serv-U Insecure Direct Object Reference (IDOR) VulnerabilityEPSS 0.5%CVE-2026-28469HIGHOpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path AmbiguityEPSS 0.5%CVE-2024-46937CRITICALAn improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication SEPSS 0.5%CVE-2026-33760HIGHLangflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 EndpointsEPSS 0.5%CVE-2026-45830HIGHA lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily rEPSS 0.5%CVE-2022-40206MEDIUMWordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerabilityEPSS 0.5%CVE-2022-3413MEDIUMIncorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, EPSS 0.5%CVE-2024-0580MEDIUMOmission of key-controlled authorization in QsigeEPSS 0.5%CVE-2026-5167MEDIUMMasteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook EndpointEPSS 0.5%CVE-2024-50689CRITICALSunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the orgService APIEPSS 0.5%CVE-2024-50686CRITICALSunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the commonService EPSS 0.5%CVE-2024-1604MEDIUMIncorrect authorization in BMC Control-MEPSS 0.5%