Weaknesses of type CWE-285

1,726 results

Falha na verificação de autorização

A aplicação não valida ou valida incorretamente se um usuário tem permissão para acessar um recurso ou executar uma ação. O código assume que autenticação (saber quem é) é suficiente, ignorando autorização (saber o que pode fazer), permitindo que usuários acessem dados ou façam operações que não deveriam.

Example

Um usuário comum consegue listar faturas de outro cliente porque a API verifica se ele está logado, mas não valida se aquela fatura pertence a ele. Ou um analista consegue executar uma exclusão em massa porque o botão existe no HTML, mas o backend não checa se ele tem permissão de admin.

How to mitigate

Implemente verificações de autorização em toda operação sensível: antes de retornar dados, valide se o usuário autenticado tem acesso àquele recurso específico (RBAC, ABAC ou ACL). Teste permissões no backend sempre, nunca confie em controles apenas na UI.

CVE-2022-31167HIGHXWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same referenceEPSS 0.8%CVE-2021-22862—Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forksEPSS 0.8%CVE-2019-1859HIGHCisco Small Business Switches Secure Shell Certificate Authentication Bypass VulnerabilityEPSS 0.8%CVE-2024-2317LOWBdtask Hospital AutoManager Prescription Page improper authorizationEPSS 0.8%CVE-2024-21137MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 aEPSS 0.8%CVE-2025-1226MEDIUMywoa setup.jsp improper authorizationEPSS 0.8%CVE-2019-15610—Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.EPSS 0.8%CVE-2022-39902MEDIUMImproper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEIEPSS 0.8%CVE-2026-105284CRITICALTotolink A3002MU Authentication Check boa sub_40FCFC improper authorizationEPSS 0.8%CVE-2021-25973MEDIUMPublify - Improper Authorization Leads to Guest Signup Restriction BypassEPSS 0.8%CVE-2021-28567MEDIUMMagento Commerce improper authorization allows an authenticated user to perform certain functions without permissionEPSS 0.8%CVE-2024-7578MEDIUMAlien Technology ALR-F800 cmd.php improper authorizationEPSS 0.8%CVE-2022-31168MEDIUMZulip Server insufficient authorization for changing bot rolesEPSS 0.8%CVE-2024-4819MEDIUMCampcodes Online Laundry Management System admin_class.php improper authorizationEPSS 0.8%CVE-2023-28634HIGHGLPI vulnerable to Privilege Escalation from Technician to Super-AdminEPSS 0.8%CVE-2018-14637MEDIUMThe SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can eEPSS 0.8%CVE-2021-28500CRITICALAn issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.EPSS 0.8%CVE-2026-61833HIGHzot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletionEPSS 0.8%CVE-2022-39329LOWProfile of disabled user stays accessibleEPSS 0.8%CVE-2020-26246HIGHAuthorization bypass in PimcoreEPSS 0.8%