Weaknesses of type CWE-639

2,490 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-63307HIGHChat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasourceEPSS 0.4%CVE-2026-69160MEDIUMOpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation APIEPSS 0.4%CVE-2026-76634HIGHWeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.phpEPSS 0.4%CVE-2026-47408MEDIUMpraisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownershipEPSS 0.4%CVE-2026-47198HIGHPaymenter: URL parameter injection bypasses paid plan limits at checkoutEPSS 0.4%CVE-2026-34044HIGHCoolify: Cross-team IDOR in logs component (resource lookup not team-scoped)EPSS 0.4%CVE-2026-6570MEDIUMkodcloud KodExplorer systemMember.class.php initInstall authorizationEPSS 0.4%CVE-2026-3688HIGHWCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role OverwriteEPSS 0.4%CVE-2026-6008MEDIUMIDOR in Im Park's DijiDemiEPSS 0.4%CVE-2024-56143HIGHStrapi Allows Unauthorized Access to Private Fields via parms.lookupEPSS 0.4%CVE-2026-62279HIGHLubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership CheckEPSS 0.4%CVE-2023-38051CRITICALA BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2026-13399HIGHPayment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal OrderEPSS 0.4%CVE-2023-38053CRITICALA BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2023-49765MEDIUMWordPress Rate my Post – WP Rating System Plugin <= 3.4.1 is vulnerable to Insecure Direct Object References (IDOR)EPSS 0.4%CVE-2023-38048CRITICALA BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2023-38052CRITICALA BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2023-38054CRITICALA BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2026-19130MEDIUMProvider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorizationEPSS 0.4%CVE-2025-9559MEDIUMPega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read dataEPSS 0.4%