Weaknesses of type CWE-285

1,722 results

Falha na verificação de autorização

A aplicação não valida ou valida incorretamente se um usuário tem permissão para acessar um recurso ou executar uma ação. O código assume que autenticação (saber quem é) é suficiente, ignorando autorização (saber o que pode fazer), permitindo que usuários acessem dados ou façam operações que não deveriam.

Example

Um usuário comum consegue listar faturas de outro cliente porque a API verifica se ele está logado, mas não valida se aquela fatura pertence a ele. Ou um analista consegue executar uma exclusão em massa porque o botão existe no HTML, mas o backend não checa se ele tem permissão de admin.

How to mitigate

Implemente verificações de autorização em toda operação sensível: antes de retornar dados, valide se o usuário autenticado tem acesso àquele recurso específico (RBAC, ABAC ou ACL). Teste permissões no backend sempre, nunca confie em controles apenas na UI.

CVE-2021-41308—Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File RepliEPSS 1.0%CVE-2021-22863—Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requestsEPSS 1.0%CVE-2022-31025LOWInvite bypasses user approval in DiscourseEPSS 1.0%CVE-2022-31247CRITICALRancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)EPSS 1.0%CVE-2020-5240HIGH2FA bypass through deleting devices in wagtail-2faEPSS 1.0%CVE-2025-23042HIGHGradio Blocked Path ACL Bypass VulnerabilityEPSS 1.0%CVE-2022-23542HIGHOpenFGA Authorization BypassEPSS 1.0%CVE-2022-26857CRITICALDell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user wEPSS 1.0%CVE-2019-13416—Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on theEPSS 1.0%CVE-2021-21432HIGHReject unauthorized access with GitHub PATsEPSS 1.0%CVE-2017-0892—Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to EPSS 1.0%CVE-2025-30390CRITICALAzure ML Compute Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2021-42330HIGHShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1EPSS 1.0%CVE-2026-27823HIGHRemote Code Execution Vulnerability in EGroupwareEPSS 1.0%CVE-2026-62835CRITICALAzure Portal Information Disclosure VulnerabilityEPSS 1.0%CVE-2019-13554—GE Mark VIe Controller has an unsecured Telnet protocol that may allow a user to create an authenticated session using generic default credeEPSS 1.0%CVE-2025-24418HIGHAdobe Commerce | Improper Authorization (CWE-285)EPSS 1.0%CVE-2021-22861—Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositoriesEPSS 1.0%CVE-2022-22288HIGHImproper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist.EPSS 0.9%CVE-2023-3805HIGHXiamen Four Letter Video Surveillance Management System Login UserInfoAction.class improper authorizationEPSS 0.9%