Weaknesses of type CWE-639

2,490 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2025-64105MEDIUMFOSSBilling: IDOR Vulnerability in Support Ticket CreationEPSS 0.4%CVE-2026-64969MEDIUMInsecure Direct Object Reference in ATutorEPSS 0.4%CVE-2026-27708HIGHFOSSBilling: IDOR in Servicecustom Client API allows cross-client data accessEPSS 0.4%CVE-2025-62180HIGHPega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.EPSS 0.4%CVE-2025-25952MEDIUMAn Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutions Pvt Ltd Academia SEPSS 0.4%CVE-2025-69347HIGHWordPress WPSubscription plugin <= 1.8.10 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2026-50283MEDIUMCraft CMS: Unauthorized Deletion of Source Assets During File ReplacementEPSS 0.4%CVE-2026-59190HIGHGrav Admin Plugin — IDOR Privilege Escalation via saveUser()EPSS 0.4%CVE-2026-42463HIGHSQLBot: Unauthorized Access VulnerabilityEPSS 0.4%CVE-2026-57869HIGHBroken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers tEPSS 0.4%CVE-2026-76236HIGHstigmem before 0.9.0a12 Cross-Tenant BOLA via TombstonesEPSS 0.4%CVE-2026-57868HIGHMicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: throEPSS 0.4%CVE-2026-54602HIGHFastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecordEPSS 0.4%CVE-2026-46712LOWMisskey: Lack of proper permission checks in Direct Messaging featureEPSS 0.4%CVE-2025-53208HIGHWordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) VulnerabilityEPSS 0.4%CVE-2026-59254MEDIUMn8n - External Secrets Disclosure via Workflow Node ExpressionsEPSS 0.4%CVE-2026-57870MEDIUMBroken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other orgaEPSS 0.4%CVE-2026-88865HIGHAVideo Missing Authorization via getRestream.json.phpEPSS 0.4%CVE-2025-52447HIGHAuthorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc commanEPSS 0.4%CVE-2026-47417HIGHpraisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOREPSS 0.4%