Weaknesses of type CWE-639

2,490 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-45671HIGHOpen WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletionEPSS 0.4%CVE-2026-9087MEDIUMKeycloak: cross-session email verification proof not bound to upstream identity in first-broker-loginEPSS 0.4%CVE-2026-27705MEDIUMPlane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patchEPSS 0.4%CVE-2026-26078HIGHDiscourse has authentication bypass vulnerability in the Patreon plugin webhook endpointEPSS 0.4%CVE-2024-4151HIGHImproper Access Control in lunary-ai/lunaryEPSS 0.4%CVE-2024-45786HIGHImproper Authorization VulnerabilityEPSS 0.4%CVE-2026-4945MEDIUMOtter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification BypassEPSS 0.4%CVE-2024-34520HIGHAn authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allowsEPSS 0.4%CVE-2026-25782MEDIUMGitea tracked-time deletion can target entries from another issueEPSS 0.4%CVE-2025-58137HIGHApache Fineract: IDOR via self-service APIEPSS 0.4%CVE-2023-38055CRITICALA BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2026-18275MEDIUMAuthorization Bypass Through User-Controlled Key in eScriptoriumEPSS 0.4%CVE-2026-7651MEDIUMUser Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' ParameterEPSS 0.4%CVE-2026-45551MEDIUMGroup-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting WriteEPSS 0.4%CVE-2026-69114HIGHSpacebar Server Cross-Channel Message Deletion via Permission Check BypassEPSS 0.4%CVE-2026-58447HIGHInvidious - Cross-User Playlist Video Deletion via Missing Ownership CheckEPSS 0.4%CVE-2026-65981HIGHCoturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeoverEPSS 0.4%CVE-2026-5060MEDIUMMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment DeletionEPSS 0.4%CVE-2024-9700MEDIUMForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission ManipulationEPSS 0.4%CVE-2026-53644HIGHFOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active ordersEPSS 0.4%