Weaknesses of type CWE-915

205 results

Modificação descontrolada de atributos de objetos determinados dinamicamente

A aplicação permite que um atacante modifique atributos de um objeto através de entrada do usuário sem validação adequada, porque o nome ou referência do atributo é construído dinamicamente a partir de dados não confiáveis. Isso pode levar a lógica de negócio comprometida, bypass de controles de acesso ou alteração de dados sensíveis.

Example

Um sistema web usa reflection ou mapeamento automático para atribuir parâmetros HTTP diretamente a propriedades de um objeto modelo (ex: `user.__proto__.isAdmin = true`). Um atacante envia `isAdmin=true` ou manipula o protótipo do objeto, escalando seus privilégios sem autenticação apropriada.

How to mitigate

Implemente um whitelist explícito de atributos que podem ser modificados dinamicamente, nunca permita entrada do usuário determinar diretamente qual propriedade será alterada. Desabilite reflection ou mapeamento automático em camadas sensíveis, e valide rigorosamente tipos e valores antes de qualquer atribuição.

CVE-2026-23522LOWLobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File DeletionEPSS 0.2%CVE-2026-45058CRITICALelecterm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmarkEPSS 0.2%CVE-2026-103036MEDIUM@orpc/json-schema: Prototype injection in smart coercionEPSS 0.2%CVE-2026-96378MEDIUMCommerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179EPSS 0.2%CVE-2026-28219LOWPrivilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global BannersEPSS 0.2%CVE-2026-15083MEDIUMECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074EPSS 0.2%CVE-2026-61591HIGHdjust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)EPSS 0.2%CVE-2026-55736MEDIUMPrivate action arguments can be set by user input in AshEPSS 0.2%CVE-2025-14341HIGHInput Data Manipulation in DivvyDrive Information Technologies' DivvyDriveEPSS 0.2%CVE-2026-31251HIGHCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in EPSS 0.2%CVE-2026-106100HIGHPayload: Field-level write access bypass in Payload on MongoDBEPSS 0.2%CVE-2026-93477MEDIUMPrivate action arguments can be set by user input on the bulk destroy and bulk update paths in AshEPSS 0.2%CVE-2026-42862HIGHFlowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource ReassignmentEPSS 0.2%CVE-2026-93364MEDIUMBludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()EPSS 0.2%CVE-2026-42540MEDIUMIRIS has a Mass Assignment issueEPSS 0.2%CVE-2026-110804MEDIUMImproperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authentiEPSS 0.2%CVE-2026-8327MEDIUMConcrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.EPSS 0.2%CVE-2026-46517HIGHLMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-outEPSS 0.2%CVE-2026-13720MEDIUMEditor can forge file-provisioning provenance on dashboards via the dashboard APIEPSS 0.2%CVE-2026-31252MEDIUMCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in EPSS 0.1%