Weaknesses of type CWE-915

167 results

Modificação descontrolada de atributos de objetos determinados dinamicamente

A aplicação permite que um atacante modifique atributos de um objeto através de entrada do usuário sem validação adequada, porque o nome ou referência do atributo é construído dinamicamente a partir de dados não confiáveis. Isso pode levar a lógica de negócio comprometida, bypass de controles de acesso ou alteração de dados sensíveis.

Example

Um sistema web usa reflection ou mapeamento automático para atribuir parâmetros HTTP diretamente a propriedades de um objeto modelo (ex: `user.__proto__.isAdmin = true`). Um atacante envia `isAdmin=true` ou manipula o protótipo do objeto, escalando seus privilégios sem autenticação apropriada.

How to mitigate

Implemente um whitelist explícito de atributos que podem ser modificados dinamicamente, nunca permita entrada do usuário determinar diretamente qual propriedade será alterada. Desabilite reflection ou mapeamento automático em camadas sensíveis, e valide rigorosamente tipos e valores antes de qualquer atribuição.

CVE-2026-71473HIGHAcm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spokeEPSS 0.3%CVE-2026-46478HIGHFlowise: DatasetRow create+update mass-assignment allows cross-workspace row takeoverEPSS 0.3%CVE-2026-63428MEDIUMHeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field setEPSS 0.3%CVE-2026-45687HIGHRocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessageEPSS 0.3%CVE-2025-66451MEDIUMLibreChat's Improper Input Validation in Prompt Creation API Enables Unauthorized Permission ChangesEPSS 0.3%CVE-2026-46479HIGHFlowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeoverEPSS 0.3%CVE-2026-46475HIGHFlowise: Assistant create+update mass-assignment allows cross-workspace assistant takeoverEPSS 0.3%CVE-2026-46477HIGHFlowise: Dataset create+update mass-assignment allows cross-workspace dataset takeoverEPSS 0.3%CVE-2026-46476HIGHFlowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeoverEPSS 0.3%CVE-2026-46480HIGHFlowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeoverEPSS 0.3%CVE-2026-41267HIGHFlowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization AssociationEPSS 0.3%CVE-2026-63102MEDIUMrConfig Core < 8.2.8 Privilege Escalation via Users API role fieldEPSS 0.3%CVE-2026-59284MEDIUMSpring Cloud Commons no allow list for writable env actuator endpointEPSS 0.3%CVE-2026-24140LOWMyTube has Mass Assignment via Settings ManagementEPSS 0.3%CVE-2026-28781HIGHCraft Affected by Entries Authorship Spoofing via Mass AssignmentEPSS 0.3%CVE-2026-92217MEDIUMa2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributesEPSS 0.3%CVE-2026-12436HIGHImproperly Controlled Modification of Dynamically-Determined Object Attributes in GitLabEPSS 0.3%CVE-2026-59888MEDIUMjackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyEPSS 0.3%CVE-2026-45396MEDIUMOpen WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data ManipulationEPSS 0.3%CVE-2026-32742MEDIUMParse Server session creation endpoint allows overwriting server-generated session fieldsEPSS 0.3%