Weaknesses of type CWE-639

2,490 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-71507HIGHDolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account RoutesEPSS 0.4%CVE-2026-5060MEDIUMMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment DeletionEPSS 0.4%CVE-2026-69114HIGHSpacebar Server Cross-Channel Message Deletion via Permission Check BypassEPSS 0.4%CVE-2026-53675MEDIUMBuddyPress 14.4.0 Friends List IDOR via REST APIEPSS 0.4%CVE-2026-95683MEDIUMMISP Overmind Event View Discloses Report Content Bypassing Report-Level ACLEPSS 0.4%CVE-2025-10910CRITICALGaining remote control over Govee devicesEPSS 0.4%CVE-2024-1744CRITICALIDOR in Ariva Computer's Accord ORSEPSS 0.4%CVE-2026-47419HIGHpraisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOREPSS 0.4%CVE-2026-54052CRITICALn8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deploymentsEPSS 0.4%CVE-2023-38513MEDIUMWordPress Photo Engine Plugin <= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR)EPSS 0.4%CVE-2026-78075MEDIUMJoomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10EPSS 0.4%CVE-2026-44776MEDIUMKavita: IDOR in /api/Download/*EPSS 0.4%CVE-2026-56215HIGHCapgo - Account Merge via Poisoned public.users.email in SSO ProvisioningEPSS 0.4%CVE-2026-47415HIGHpraisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOREPSS 0.4%CVE-2026-77035MEDIUMJoomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1EPSS 0.4%CVE-2026-67331HIGHbetter-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization BypassEPSS 0.4%CVE-2026-65709HIGHsysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC APIEPSS 0.4%CVE-2026-1664MEDIUMInsecure Direct Object Reference (IDOR) via Header-Based Email RoutingEPSS 0.4%CVE-2024-3305HIGHIDOR in Utarit Information's SoliClubEPSS 0.4%CVE-2023-7049MEDIUMCustom Field For WP Job Manager <= 1.2 - Insecure Direct Object Reference to Sensitive Information Exposure via ShortcodeEPSS 0.4%