Weaknesses of type CWE-285

1,587 results

Falha na verificação de autorização

A aplicação não valida ou valida incorretamente se um usuário tem permissão para acessar um recurso ou executar uma ação. O código assume que autenticação (saber quem é) é suficiente, ignorando autorização (saber o que pode fazer), permitindo que usuários acessem dados ou façam operações que não deveriam.

Example

Um usuário comum consegue listar faturas de outro cliente porque a API verifica se ele está logado, mas não valida se aquela fatura pertence a ele. Ou um analista consegue executar uma exclusão em massa porque o botão existe no HTML, mas o backend não checa se ele tem permissão de admin.

How to mitigate

Implemente verificações de autorização em toda operação sensível: antes de retornar dados, valide se o usuário autenticado tem acesso àquele recurso específico (RBAC, ABAC ou ACL). Teste permissões no backend sempre, nunca confie em controles apenas na UI.

CVE-2021-41313—Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configuratEPSS 0.9%CVE-2022-30746HIGHMissing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript intEPSS 0.9%CVE-2022-36110HIGHNetmaker vulnerable to Insufficient Granularity of Access ControlEPSS 0.9%CVE-2024-11860MEDIUMSourceCodester Best House Rental Management System POST Request ajax.php improper authorizationEPSS 0.9%CVE-2023-0813HIGHNetwork-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforcedEPSS 0.9%CVE-2024-26193MEDIUMAzure Migrate Remote Code Execution VulnerabilityEPSS 0.9%CVE-2021-23140CRITICALImproper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised CommandEPSS 0.9%CVE-2024-3840MEDIUMInsufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation resEPSS 0.9%CVE-2022-29236MEDIUMImproper access control for pencil annotations in BigBlueButtonEPSS 0.9%CVE-2020-5250HIGHPossible information disclosure in PrestaShopEPSS 0.9%CVE-2020-5251HIGHInformation disclosure in parse-serverEPSS 0.8%CVE-2021-42336MEDIUMHuachu Digital Technology Co.,Ltd. Easytest - Improper AuthorizationEPSS 0.8%CVE-2021-28501CRITICALAn issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.EPSS 0.8%CVE-2025-30389HIGHAzure Bot Framework SDK Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2019-1859HIGHCisco Small Business Switches Secure Shell Certificate Authentication Bypass VulnerabilityEPSS 0.8%CVE-2021-22862—Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forksEPSS 0.8%CVE-2024-2317LOWBdtask Hospital AutoManager Prescription Page improper authorizationEPSS 0.8%CVE-2024-21137MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 aEPSS 0.8%CVE-2025-1226MEDIUMywoa setup.jsp improper authorizationEPSS 0.8%CVE-2019-15610—Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.EPSS 0.8%