Falhas do tipo CWE-915

205 resultados

Modificação descontrolada de atributos dinâmicos de objetos

Ocorre quando a aplicação permite que usuários modifiquem atributos de objetos sem validação adequada, especialmente em linguagens que permitem criar propriedades dinamicamente (como Python, JavaScript, PHP). Um atacante consegue injetar ou sobrescrever atributos críticos — flags de admin, valores monetários, referências internas — alterando o comportamento da aplicação.

Exemplo

Um sistema em Python recebe JSON do usuário e faz `user.__dict__.update(request.json)` para popular dados de perfil. O atacante envia `{"is_admin": true}` e ganha privilégios sem autorização, porque nenhuma validação protege qual atributo pode ser modificado.

Como mitigar

Use listas explícitas de propriedades permitidas (whitelist) para update de objetos. Separe dados de entrada (DTO/schema) de modelos internos, mapeando apenas campos seguros. Nunca faça merge direto de entrada de usuário em atributos de objetos críticos.

CVE-2026-77144HIGHBroken Access Control in extension "Events 2" (events2)EPSS 0.4%CVE-2026-56679HIGH9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgradeEPSS 0.4%CVE-2026-6366MEDIUMDrupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002EPSS 0.4%CVE-2026-85408MEDIUMEleveo Quality Management Conversation events dynamically-determined object attributesEPSS 0.4%CVE-2026-61834MEDIUMscim-patch: Mutation of Inherited Built-in Method ObjectsEPSS 0.4%CVE-2026-53958HIGH4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass AssignmentEPSS 0.4%CVE-2026-107249CRITICALBlock AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192EPSS 0.4%CVE-2026-29056HIGHKanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become adminEPSS 0.4%CVE-2026-17598MEDIUMNexus Repository 3 - Improper Input Validation in Scheduled Task ConfigurationEPSS 0.4%CVE-2026-28781HIGHCraft Affected by Entries Authorship Spoofing via Mass AssignmentEPSS 0.4%CVE-2024-10359MEDIUMMass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechatEPSS 0.4%CVE-2026-78038MEDIUMJob argument injection via :args overrides primary_key and tenant in AshObanEPSS 0.4%CVE-2026-105863CRITICALPayload authentication token field handling issueEPSS 0.4%CVE-2026-45229HIGHQuark Drive (quark-auto-save) < 0.8.5 Mass Assignment via POST /updateEPSS 0.4%CVE-2026-56276MEDIUMFlowise - Mass Assignment in PUT /api/v1/user Allows Password Hash OverrideEPSS 0.4%CVE-2026-44635HIGHKysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`EPSS 0.4%CVE-2026-46721MEDIUMBroken Access Control in extension "Frontend User Registration" (sf_register)EPSS 0.4%CVE-2026-120448HIGHDoraCMS through 3.1.0 Mass Assignment via API Key Update EndpointEPSS 0.4%CVE-2026-109186HIGHjshERP through 3.6 Mass Assignment via PUT /user/updateEPSS 0.4%CVE-2026-22783CRITICALIris Allows Arbitrary File Deletion via Mass Assignment in Datastore File ManagementEPSS 0.4%