Weaknesses of type CWE-639

2,490 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-54746MEDIUMHatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and UnsubscribeEPSS 0.4%CVE-2026-48052MEDIUMPapra: Cross-organization tag deletion and modification via authenticated cross-tenant requestEPSS 0.4%CVE-2026-9812MEDIUMMissing property field ownership validation in Playbooks run property update endpointEPSS 0.4%CVE-2026-42861HIGHFlowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource ReassignmentEPSS 0.4%CVE-2026-7144MEDIUM1000 Projects Portfolio Management System MCA update_passwd_process.php authorizationEPSS 0.4%CVE-2026-13381HIGHVSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and DeletionEPSS 0.4%CVE-2024-7041MEDIUMIDOR in open-webui/open-webuiEPSS 0.4%CVE-2026-63735HIGHSurrealDB before 3.2.0 Authentication Bypass via Custom APIEPSS 0.4%CVE-2026-2698MEDIUMImproper Access ControlEPSS 0.4%CVE-2026-46441HIGHFlowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource ReassignmentEPSS 0.4%CVE-2024-13558HIGHNP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information DisclosureEPSS 0.4%CVE-2026-94494MEDIUMjshERP through 3.6 Tenant Information Disclosure via GET /tenant/infoEPSS 0.4%CVE-2025-51865HIGHAi2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object Reference (IDOR), alEPSS 0.4%CVE-2024-43322MEDIUMWordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2026-42863HIGHFlowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow ReassignmentEPSS 0.4%CVE-2024-5619CRITICALIDOR in PruvaSoft Informatics' Apinizer Management ConsoleEPSS 0.4%CVE-2024-12335MEDIUMAvada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post DisclosureEPSS 0.4%CVE-2026-1375HIGHTutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and DeletionEPSS 0.4%CVE-2026-70488MEDIUMOpen WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanupEPSS 0.4%CVE-2026-58445LOWCross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APIEPSS 0.4%