Weaknesses of type CWE-639

2,495 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-35173MEDIUMChyrp Lite has an IDOR via Mass Assignment in Post ModelEPSS 0.3%CVE-2026-81428MEDIUMWC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOREPSS 0.3%CVE-2026-33703HIGHChamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API TokensEPSS 0.3%CVE-2026-88844LOWMasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOREPSS 0.3%CVE-2026-41127MEDIUMBigBlueButton's missing authorization allows viewer to inject/overwrite captionsEPSS 0.3%CVE-2024-39897MEDIUMCache driver GetBlob() allows read access to any blob without access control checkEPSS 0.3%CVE-2026-89257MEDIUMAVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership CheckEPSS 0.3%CVE-2025-15025HIGHIDOR in Yordam Informatics' Library Automation SystemEPSS 0.3%CVE-2026-31869MEDIUMDiscourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` checkEPSS 0.3%CVE-2026-89031MEDIUMBlog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_postEPSS 0.3%CVE-2024-45232HIGHAn issue was discovered in powermail extension through 12.3.5 for TYPO3. It fails to validate the mail parameter of the confirmationAction, EPSS 0.3%CVE-2026-9130HIGHLangflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcementEPSS 0.3%CVE-2025-49135MEDIUMCVAT missing validation for in-progress backup upload namesEPSS 0.3%CVE-2026-84062MEDIUMBurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploitedEPSS 0.3%CVE-2024-4154HIGHIncorrect Synchronization in lunary-ai/lunaryEPSS 0.3%CVE-2023-32669MEDIUMAuthorization Bypass on BuddyBossEPSS 0.3%CVE-2026-32104MEDIUMStudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's SettingsEPSS 0.3%CVE-2025-36365MEDIUMIBM Db2 Privilege EscalationEPSS 0.3%CVE-2025-31949MEDIUMGrowatt Cloud portal Authorization Bypass Through User-Controlled KeyEPSS 0.3%CVE-2026-63095HIGHDendrite 0.13.8 Improper Authorization via POST account/3pid/delete EndpointEPSS 0.3%