Weaknesses of type CWE-639

2,495 results

Manipulação de identificador para acessar dados de outro usuário

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso solicitado, permitindo que modifique parâmetros (como IDs) para acessar dados alheios. Por exemplo, ao mudar o ID de um pedido na URL de 123 para 456, consegue visualizar pedidos de outros clientes sem controle de acesso real.

Example

Um banco digital permite acessar extratos via URL /extrato?conta_id=5000. Se um usuário muda para conta_id=5001, consegue ver o extrato de outra pessoa apenas porque a aplicação valida apenas autenticação, não autorização específica para aquele recurso.

How to mitigate

Implemente verificação de autorização em cada acesso a recurso: valide se o usuário autenticado de fato possui permissão para aquele ID específico, comparando contra dados da sessão ou banco de dados. Use abstração (ex: 'minha conta' em vez de IDs diretos) e evite expor identificadores sequenciais previsíveis.

CVE-2026-44731MEDIUMOpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosureEPSS 0.3%CVE-2026-74009MEDIUMWordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2024-21759LOWAn authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 allows attacker EPSS 0.3%CVE-2026-45563MEDIUMRoxy-WI: IDOR — any authenticated user can read another user's full action historyEPSS 0.3%CVE-2026-31150MEDIUMIncorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's daEPSS 0.3%CVE-2026-86743MEDIUMSnipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance ReportEPSS 0.3%CVE-2025-3519HIGHReplace uploaded files knowing the file upload IDEPSS 0.3%CVE-2026-57676MEDIUMWordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-53863MEDIUMOpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group PolicyEPSS 0.3%CVE-2026-27956MEDIUMCoolify: Cross-team application domain enumeration via domains_by_server endpointEPSS 0.3%CVE-2025-14772HIGHBroken Access Control in ABB T-MAC Plus web applicationEPSS 0.3%CVE-2026-12204MEDIUMShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorizationEPSS 0.3%CVE-2026-32533MEDIUMWordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-96762MEDIUMkvcache-ai mooncake RPC Path UnmountSegment authorizationEPSS 0.3%CVE-2026-8347LOWConcrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialogEPSS 0.3%CVE-2025-27561MEDIUMGrowatt Cloud portal Authorization Bypass Through User-Controlled KeyEPSS 0.3%CVE-2024-29020MEDIUMJumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leakedEPSS 0.3%CVE-2024-42422HIGHDell NetWorker, version(s) 19.10, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability. An unauthenticated attacker EPSS 0.3%CVE-2025-27565MEDIUMGrowatt Cloud portal Authorization Bypass Through User-Controlled KeyEPSS 0.3%CVE-2026-39616MEDIUMWordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%