Falhas do tipo CWE-639

2.451 resultados

Manipulação de identificadores para contornar controle de acesso

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso identificado pelo parâmetro fornecido (ID de registro, número de documento, etc.). Um atacante modifica esse parâmetro para acessar dados de outros usuários — por exemplo, mudando `user_id=123` para `user_id=124` na URL e obtendo informações alheias sem autenticação adicional.

Exemplo

Um banco permite visualizar extrato em `/api/extrato?conta=1001`. Um cliente autenticado como `user_123` descobre que pode acessar `/api/extrato?conta=1002` e ver o extrato completo de outra pessoa, porque o servidor apenas verifica se há uma sessão válida, não se aquele usuário é dono da conta 1002.

Como mitigar

Implemente validação de propriedade em cada requisição: antes de retornar dados, confirme que o ID do recurso pertence ao usuário autenticado. Use referências indiretas (tokens opacos) em vez de IDs sequenciais previsíveis, e aplique testes automatizados que tentam acessar recursos de outros usuários.

CVE-2023-35916HIGHWordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)EPSS 0.6%CVE-2026-52837MEDIUMEasy!Appointments has unauthenticated customer PII disclosure on booking reschedule pageEPSS 0.6%CVE-2022-4811HIGHAuthorization Bypass Through User-Controlled Key in usememos/memosEPSS 0.6%CVE-2026-30944HIGHStudioCMS Affected by Privilege Escalation via Insecure API Token GenerationEPSS 0.6%CVE-2024-10497HIGHCWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to modify values outsEPSS 0.6%CVE-2023-1125MEDIUMRuby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOREPSS 0.6%CVE-2024-7474CRITICALIDOR in lunary-ai/lunaryEPSS 0.6%CVE-2024-11137HIGHIDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunaryEPSS 0.6%CVE-2026-9180MEDIUMMotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' ParameterEPSS 0.6%CVE-2021-41111MEDIUMAuthorization Bypass Through User-Controlled Key in RundeckEPSS 0.6%CVE-2026-46453MEDIUMApache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operationEPSS 0.6%CVE-2026-48206MEDIUMApache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured credentialsEPSS 0.6%CVE-2023-1911MEDIUMBlocksy Companion < 1.8.82 - Subscriber+ Draft Post AccessEPSS 0.5%CVE-2026-20342HIGHCisco Secure Firewall Management Center Software Low Privileged Arbitrary File Download VulnerabilityEPSS 0.5%CVE-2026-73841HIGHOpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpointsEPSS 0.5%CVE-2025-31833MEDIUMWordPress JobBoard Job listing plugin Plugin <= 1.2.8 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.5%CVE-2024-11167CRITICALImproper Access Control in danny-avila/librechatEPSS 0.5%CVE-2024-4464HIGHAuthorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 andEPSS 0.5%CVE-2026-51925HIGHA Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code vEPSS 0.5%CVE-2024-24312HIGHSQL injection vulnerability in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the ModelEPSS 0.5%