Falhas do tipo CWE-915

205 resultados

Modificação descontrolada de atributos dinâmicos de objetos

Ocorre quando a aplicação permite que usuários modifiquem atributos de objetos sem validação adequada, especialmente em linguagens que permitem criar propriedades dinamicamente (como Python, JavaScript, PHP). Um atacante consegue injetar ou sobrescrever atributos críticos — flags de admin, valores monetários, referências internas — alterando o comportamento da aplicação.

Exemplo

Um sistema em Python recebe JSON do usuário e faz `user.__dict__.update(request.json)` para popular dados de perfil. O atacante envia `{"is_admin": true}` e ganha privilégios sem autorização, porque nenhuma validação protege qual atributo pode ser modificado.

Como mitigar

Use listas explícitas de propriedades permitidas (whitelist) para update de objetos. Separe dados de entrada (DTO/schema) de modelos internos, mapeando apenas campos seguros. Nunca faça merge direto de entrada de usuário em atributos de objetos críticos.

CVE-2026-23522LOWLobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File DeletionEPSS 0.2%CVE-2026-45058CRITICALelecterm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmarkEPSS 0.2%CVE-2026-103036MEDIUM@orpc/json-schema: Prototype injection in smart coercionEPSS 0.2%CVE-2026-96378MEDIUMCommerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179EPSS 0.2%CVE-2026-28219LOWPrivilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global BannersEPSS 0.2%CVE-2026-15083MEDIUMECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074EPSS 0.2%CVE-2026-61591HIGHdjust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)EPSS 0.2%CVE-2026-55736MEDIUMPrivate action arguments can be set by user input in AshEPSS 0.2%CVE-2025-14341HIGHInput Data Manipulation in DivvyDrive Information Technologies' DivvyDriveEPSS 0.2%CVE-2026-31251HIGHCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in EPSS 0.2%CVE-2026-106100HIGHPayload: Field-level write access bypass in Payload on MongoDBEPSS 0.2%CVE-2026-93477MEDIUMPrivate action arguments can be set by user input on the bulk destroy and bulk update paths in AshEPSS 0.2%CVE-2026-42862HIGHFlowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource ReassignmentEPSS 0.2%CVE-2026-93364MEDIUMBludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()EPSS 0.2%CVE-2026-42540MEDIUMIRIS has a Mass Assignment issueEPSS 0.2%CVE-2026-110804MEDIUMImproperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authentiEPSS 0.2%CVE-2026-8327MEDIUMConcrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.EPSS 0.2%CVE-2026-46517HIGHLMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-outEPSS 0.2%CVE-2026-13720MEDIUMEditor can forge file-provisioning provenance on dashboards via the dashboard APIEPSS 0.2%CVE-2026-31252MEDIUMCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in EPSS 0.1%