Weaknesses of type CWE-285

1,726 results

Falha na verificação de autorização

A aplicação não valida ou valida incorretamente se um usuário tem permissão para acessar um recurso ou executar uma ação. O código assume que autenticação (saber quem é) é suficiente, ignorando autorização (saber o que pode fazer), permitindo que usuários acessem dados ou façam operações que não deveriam.

Example

Um usuário comum consegue listar faturas de outro cliente porque a API verifica se ele está logado, mas não valida se aquela fatura pertence a ele. Ou um analista consegue executar uma exclusão em massa porque o botão existe no HTML, mas o backend não checa se ele tem permissão de admin.

How to mitigate

Implemente verificações de autorização em toda operação sensível: antes de retornar dados, valide se o usuário autenticado tem acesso àquele recurso específico (RBAC, ABAC ou ACL). Teste permissões no backend sempre, nunca confie em controles apenas na UI.

CVE-2018-1082—A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but laterEPSS 2.0%CVE-2017-12160—It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication serveEPSS 1.9%CVE-2020-3374CRITICALCisco SD-WAN vManage Software Authorization Bypass VulnerabilityEPSS 1.9%CVE-2018-0460—Cisco Enterprise NFV Infrastructure Software Information Disclosure VulnerabilityEPSS 1.9%CVE-2024-38231MEDIUMWindows Remote Desktop Licensing Service Denial of Service VulnerabilityEPSS 1.9%CVE-2020-24404LOWIncorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST APIEPSS 1.9%CVE-2018-15405—Cisco Integrated Management Controller Supervisor and Cisco UCS Director Authenticated Web Interface Information Disclosure VulnerabilityEPSS 1.8%CVE-2025-21348HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.8%CVE-2021-21026MEDIUMMagento Commerce Incorrect permissions Could Lead To Unauthorized AccessEPSS 1.8%CVE-2025-4210MEDIUMCasdoor SCIM User Creation Endpoint scim.go HandleScim authorizationEPSS 1.8%CVE-2021-36037MEDIUMMagento Commerce Improper Authorization Vulnerability Could Lead To Information ExposureEPSS 1.8%CVE-2018-0459—Cisco Enterprise NFV Infrastructure Software Denial of Service VulnerabilityEPSS 1.8%CVE-2021-1574HIGHCisco Business Process Automation Privilege Escalation VulnerabilitiesEPSS 1.7%CVE-2021-39317HIGHAccessPress Themes - Authenticated Malicious File UploadEPSS 1.7%CVE-2019-1863MEDIUMCisco Integrated Management Controller Privilege Escalation VulnerabilityEPSS 1.7%CVE-2021-27663HIGHCEM Systems AC2000EPSS 1.7%CVE-2025-29827CRITICALAzure Automation Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2023-32168HIGHD-Link D-View showUser Improper Authorization Privilege Escalation VulnerabilityEPSS 1.6%CVE-2020-24403LOWIncorrect permissions could lead to unauthorized modification of inventory source data via REST APIEPSS 1.6%CVE-2025-31255CRITICALAn authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS EPSS 1.6%