Weaknesses of type CWE-285

1,601 results

Falha na verificação de autorização

A aplicação não valida ou valida incorretamente se um usuário tem permissão para acessar um recurso ou executar uma ação. O código assume que autenticação (saber quem é) é suficiente, ignorando autorização (saber o que pode fazer), permitindo que usuários acessem dados ou façam operações que não deveriam.

Example

Um usuário comum consegue listar faturas de outro cliente porque a API verifica se ele está logado, mas não valida se aquela fatura pertence a ele. Ou um analista consegue executar uma exclusão em massa porque o botão existe no HTML, mas o backend não checa se ele tem permissão de admin.

How to mitigate

Implemente verificações de autorização em toda operação sensível: antes de retornar dados, valide se o usuário autenticado tem acesso àquele recurso específico (RBAC, ABAC ou ACL). Teste permissões no backend sempre, nunca confie em controles apenas na UI.

CVE-2026-39901MEDIUMmonetr: Protected Transactions Deletable via PUTEPSS 0.3%CVE-2023-32967MEDIUMQTS, QuTScloudEPSS 0.3%CVE-2026-4818MEDIUMSome management operations on data streams are not properly restricted when user does not have the necessary privilegesEPSS 0.3%CVE-2024-21031MEDIUMVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versioEPSS 0.3%CVE-2024-21018MEDIUMVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versioEPSS 0.3%CVE-2024-21039MEDIUMVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versioEPSS 0.3%CVE-2022-46312—The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexpEPSS 0.3%CVE-2025-57438MEDIUMThe 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability. Certain sensitive endpoints are intended to be accessible EPSS 0.3%CVE-2025-13115MEDIUMmacrozheng mall-swarm/mall Order Details detail improper authorizationEPSS 0.3%CVE-2025-15120LOWJeecgBoot getDeptRoleList improper authorizationEPSS 0.3%CVE-2026-41572MEDIUMNote Mark: Unauthenticated read of notes and assets in soft-deleted public booksEPSS 0.3%CVE-2026-17531LOWunitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorizationEPSS 0.3%CVE-2026-13534LOWCherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorizationEPSS 0.3%CVE-2026-54012HIGHOpen WebUI: Forged model meta.knowledge allows cross-user file read and deletionEPSS 0.3%CVE-2025-10319MEDIUMJeecgBoot Tenant Log Export exportLog improper authorizationEPSS 0.3%CVE-2026-21587HIGHThis High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This ImEPSS 0.3%CVE-2025-30373MEDIUMGraylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong valueEPSS 0.3%CVE-2026-18144MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.3%CVE-2020-3394HIGHCisco Nexus 3000 and 9000 Series Switches Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-21586HIGHThis High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, EPSS 0.3%