Weaknesses of type CWE-639

2,490 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2025-11517HIGHEvent Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment BypassEPSS 0.4%CVE-2026-55611NONEAnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)EPSS 0.4%CVE-2026-19966MEDIUMCodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorizationEPSS 0.4%CVE-2026-6583MEDIUMTransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorizationEPSS 0.4%CVE-2026-6585MEDIUMTransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorizationEPSS 0.4%CVE-2026-46558HIGHPlane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspacesEPSS 0.4%CVE-2024-32823MEDIUMWordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2026-59817MEDIUMGhost: Paid gift memberships obtainable at minimal cost via the donations featureEPSS 0.4%CVE-2026-7648MEDIUMLearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' ParameterEPSS 0.4%CVE-2025-15521CRITICALAcademy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account TakeoverEPSS 0.4%CVE-2025-0875MEDIUMIDOR in Proliz Software's OBSEPSS 0.4%CVE-2026-34044HIGHCoolify: Cross-team IDOR in logs component (resource lookup not team-scoped)EPSS 0.4%CVE-2026-68559MEDIUMWekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)EPSS 0.4%CVE-2026-76634HIGHWeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.phpEPSS 0.4%CVE-2026-52743MEDIUMGoCD before 26.1.0 is vulnerable to authorization bypass via job status APIEPSS 0.4%CVE-2023-30960MEDIUMInsecure Direct Object Reference (IDOR) in Foundry job-trackerEPSS 0.4%CVE-2026-76901MEDIUMCordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accountsEPSS 0.4%CVE-2024-13428MEDIUMWP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo DeletionEPSS 0.4%CVE-2026-26004MEDIUMSentry allows unauthorized access to event data across organizational boundariesEPSS 0.4%CVE-2026-28503MEDIUMTandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404EPSS 0.4%