Falhas do tipo CWE-915

165 resultados

Modificação descontrolada de atributos dinâmicos de objetos

Ocorre quando a aplicação permite que usuários modifiquem atributos de objetos sem validação adequada, especialmente em linguagens que permitem criar propriedades dinamicamente (como Python, JavaScript, PHP). Um atacante consegue injetar ou sobrescrever atributos críticos — flags de admin, valores monetários, referências internas — alterando o comportamento da aplicação.

Exemplo

Um sistema em Python recebe JSON do usuário e faz `user.__dict__.update(request.json)` para popular dados de perfil. O atacante envia `{"is_admin": true}` e ganha privilégios sem autorização, porque nenhuma validação protege qual atributo pode ser modificado.

Como mitigar

Use listas explícitas de propriedades permitidas (whitelist) para update de objetos. Separe dados de entrada (DTO/schema) de modelos internos, mapeando apenas campos seguros. Nunca faça merge direto de entrada de usuário em atributos de objetos críticos.

CVE-2026-50281HIGHCraft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elementsEPSS 0.4%CVE-2026-61598HIGHClient mass-assignment of arbitrary view attributes via the default dj-model update_model handlerEPSS 0.4%CVE-2026-72719MEDIUMChatwoot: Cross-Account Resource Transfer via `account_id` ParameterEPSS 0.4%CVE-2026-54601MEDIUMFastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusionEPSS 0.4%CVE-2026-6366MEDIUMDrupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002EPSS 0.4%CVE-2026-27125MEDIUMSvelte SSR attribute spreading includes inherited properties from prototype chainEPSS 0.4%CVE-2026-17095HIGHIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.4%CVE-2024-10359MEDIUMMass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechatEPSS 0.4%CVE-2026-54515MEDIUMjackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesEPSS 0.4%CVE-2026-29056HIGHKanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become adminEPSS 0.4%CVE-2026-45229HIGHQuark Drive (quark-auto-save) < 0.8.5 Mass Assignment via POST /updateEPSS 0.4%CVE-2026-55736MEDIUMPrivate action arguments can be set by user input in AshEPSS 0.4%CVE-2026-56276MEDIUMFlowise - Mass Assignment in PUT /api/v1/user Allows Password Hash OverrideEPSS 0.4%CVE-2026-44635HIGHKysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`EPSS 0.4%CVE-2026-46721MEDIUMBroken Access Control in extension "Frontend User Registration" (sf_register)EPSS 0.4%CVE-2026-55091HIGHflat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id keyEPSS 0.4%CVE-2026-53958HIGH4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass AssignmentEPSS 0.4%CVE-2026-55804MEDIUMDrupal core - Moderately critical - Gadget chain - SA-CORE-2026-006EPSS 0.4%CVE-2026-55803MEDIUMDrupal core - Critical - PHP object injection - SA-CORE-2026-005EPSS 0.4%CVE-2026-22783CRITICALIris Allows Arbitrary File Deletion via Mass Assignment in Datastore File ManagementEPSS 0.4%