Weaknesses of type CWE-285

1,726 results

Falha na verificação de autorização

A aplicação não valida ou valida incorretamente se um usuário tem permissão para acessar um recurso ou executar uma ação. O código assume que autenticação (saber quem é) é suficiente, ignorando autorização (saber o que pode fazer), permitindo que usuários acessem dados ou façam operações que não deveriam.

Example

Um usuário comum consegue listar faturas de outro cliente porque a API verifica se ele está logado, mas não valida se aquela fatura pertence a ele. Ou um analista consegue executar uma exclusão em massa porque o botão existe no HTML, mas o backend não checa se ele tem permissão de admin.

How to mitigate

Implemente verificações de autorização em toda operação sensível: antes de retornar dados, valide se o usuário autenticado tem acesso àquele recurso específico (RBAC, ABAC ou ACL). Teste permissões no backend sempre, nunca confie em controles apenas na UI.

CVE-2023-3805HIGHXiamen Four Letter Video Surveillance Management System Login UserInfoAction.class improper authorizationEPSS 0.9%CVE-2026-58277HIGHMicrosoft SharePoint Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2022-24083CRITICALPassword authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.EPSS 0.9%CVE-2026-32213CRITICALAzure AI Foundry Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2017-2589HIGHIt was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies arEPSS 0.9%CVE-2018-0393—A Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authenticated, remote attaEPSS 0.9%CVE-2021-3616CRITICALA vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter EPSS 0.9%CVE-2019-7479—A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected SoEPSS 0.9%CVE-2022-33713—Implicit Intent hijacking vulnerability in Samsung Cloud prior to version 5.2.0 allows attacker to get sensitive information.EPSS 0.9%CVE-2023-33189CRITICALIncorrect Authorization with specially crafted requestsEPSS 0.9%CVE-2020-8119—Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the galleryEPSS 0.9%CVE-2022-3748CRITICALImproper authorization that can lead to account impersonationEPSS 0.9%CVE-2022-39340MEDIUMOpenFGA Information DisclosureEPSS 0.9%CVE-2022-30746HIGHMissing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript intEPSS 0.9%CVE-2023-4243HIGHFULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin InstallationEPSS 0.9%CVE-2021-42337MEDIUMTVN-202110009EPSS 0.9%CVE-2021-41100HIGHAccount takeover when having only access to a user's short lived token in wire-serverEPSS 0.9%CVE-2025-30389HIGHAzure Bot Framework SDK Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2022-36110HIGHNetmaker vulnerable to Insufficient Granularity of Access ControlEPSS 0.9%CVE-2018-3829—In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invaEPSS 0.9%