Weaknesses of type CWE-285

1,729 results

Falha na verificação de autorização

A aplicação não valida ou valida incorretamente se um usuário tem permissão para acessar um recurso ou executar uma ação. O código assume que autenticação (saber quem é) é suficiente, ignorando autorização (saber o que pode fazer), permitindo que usuários acessem dados ou façam operações que não deveriam.

Example

Um usuário comum consegue listar faturas de outro cliente porque a API verifica se ele está logado, mas não valida se aquela fatura pertence a ele. Ou um analista consegue executar uma exclusão em massa porque o botão existe no HTML, mas o backend não checa se ele tem permissão de admin.

How to mitigate

Implemente verificações de autorização em toda operação sensível: antes de retornar dados, valide se o usuário autenticado tem acesso àquele recurso específico (RBAC, ABAC ou ACL). Teste permissões no backend sempre, nunca confie em controles apenas na UI.

CVE-2025-0849MEDIUMCampCodes School Management Software Staff edit-staff improper authorizationEPSS 0.5%CVE-2026-9397CRITICALBesen BS20 EV Charging Station OTA Update Installation improper authorizationEPSS 0.5%CVE-2026-108899MEDIUMtobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorizationEPSS 0.5%CVE-2026-53628MEDIUMGLPI: Unallowed authentication method update by administratorEPSS 0.5%CVE-2026-28806CRITICALImproper authorization in device bulk actions and device update API allows cross-organization device controlEPSS 0.5%CVE-2024-23576HIGHHCL Commerce is potentially affected by a denial of service and information disclosure vulnerabilityEPSS 0.5%CVE-2023-32482MEDIUM Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. An authenticated malicious user with privilegeEPSS 0.5%CVE-2026-28685MEDIUMKimai: API invoice endpoint missing customer-level access control (IDOR)EPSS 0.4%CVE-2025-4672HIGHOffsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback FunctionEPSS 0.4%CVE-2026-52825MEDIUMKimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized VisibilityEPSS 0.4%CVE-2026-84241HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.4%CVE-2023-50871MEDIUMIn JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missedEPSS 0.4%CVE-2023-29152MEDIUMPTC Vuforia Studio Improper AuthorizationEPSS 0.4%CVE-2026-21586HIGHThis High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, EPSS 0.4%CVE-2026-45503HIGHMicrosoft Exchange Server Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-21587HIGHThis High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This ImEPSS 0.4%CVE-2023-42541MEDIUMImproper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.EPSS 0.4%CVE-2024-25949HIGHDell OS10 Networking Switches, versions10.5.6.x, 10.5.5.x, 10.5.4.x and 10.5.3.x ,contain an improper authorization vulnerability. A remote EPSS 0.4%CVE-2024-43706HIGHKibana Improper AuthorizationEPSS 0.4%CVE-2024-9297MEDIUMSourceCodester Online Railway Reservation System admin improper authorizationEPSS 0.4%