Falhas do tipo CWE-639

2.482 resultados

Manipulação de identificadores para contornar controle de acesso

A aplicação não valida adequadamente se o usuário autenticado tem permissão para acessar o recurso identificado pelo parâmetro fornecido (ID de registro, número de documento, etc.). Um atacante modifica esse parâmetro para acessar dados de outros usuários — por exemplo, mudando `user_id=123` para `user_id=124` na URL e obtendo informações alheias sem autenticação adicional.

Exemplo

Um banco permite visualizar extrato em `/api/extrato?conta=1001`. Um cliente autenticado como `user_123` descobre que pode acessar `/api/extrato?conta=1002` e ver o extrato completo de outra pessoa, porque o servidor apenas verifica se há uma sessão válida, não se aquele usuário é dono da conta 1002.

Como mitigar

Implemente validação de propriedade em cada requisição: antes de retornar dados, confirme que o ID do recurso pertence ao usuário autenticado. Use referências indiretas (tokens opacos) em vez de IDs sequenciais previsíveis, e aplique testes automatizados que tentam acessar recursos de outros usuários.

CVE-2026-76634HIGHWeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.phpEPSS 0.4%CVE-2026-68559MEDIUMWekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)EPSS 0.4%CVE-2026-47198HIGHPaymenter: URL parameter injection bypasses paid plan limits at checkoutEPSS 0.4%CVE-2026-63307HIGHChat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasourceEPSS 0.4%CVE-2024-56143HIGHStrapi Allows Unauthorized Access to Private Fields via parms.lookupEPSS 0.4%CVE-2026-6570MEDIUMkodcloud KodExplorer systemMember.class.php initInstall authorizationEPSS 0.4%CVE-2026-3688HIGHWCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role OverwriteEPSS 0.4%CVE-2026-6008MEDIUMIDOR in Im Park's DijiDemiEPSS 0.4%CVE-2026-62279HIGHLubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership CheckEPSS 0.4%CVE-2023-38048CRITICALA BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2023-38051CRITICALA BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2026-13399HIGHPayment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal OrderEPSS 0.4%CVE-2023-49765MEDIUMWordPress Rate my Post – WP Rating System Plugin <= 3.4.1 is vulnerable to Insecure Direct Object References (IDOR)EPSS 0.4%CVE-2023-38052CRITICALA BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2023-38054CRITICALA BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2023-38053CRITICALA BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0EPSS 0.4%CVE-2025-9559MEDIUMPega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read dataEPSS 0.4%CVE-2026-19130MEDIUMProvider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorizationEPSS 0.4%CVE-2024-2261MEDIUMEvent Tickets and Registration <= 5.8.2 - Improper Authorization to Information DisclosureEPSS 0.4%CVE-2026-3235MEDIUMWP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data AccessEPSS 0.4%