Weaknesses of type CWE-285

1,605 results

Falha na verificação de autorização

A aplicação não valida ou valida incorretamente se um usuário tem permissão para acessar um recurso ou executar uma ação. O código assume que autenticação (saber quem é) é suficiente, ignorando autorização (saber o que pode fazer), permitindo que usuários acessem dados ou façam operações que não deveriam.

Example

Um usuário comum consegue listar faturas de outro cliente porque a API verifica se ele está logado, mas não valida se aquela fatura pertence a ele. Ou um analista consegue executar uma exclusão em massa porque o botão existe no HTML, mas o backend não checa se ele tem permissão de admin.

How to mitigate

Implemente verificações de autorização em toda operação sensível: antes de retornar dados, valide se o usuário autenticado tem acesso àquele recurso específico (RBAC, ABAC ou ACL). Teste permissões no backend sempre, nunca confie em controles apenas na UI.

CVE-2026-32615MEDIUMDiscourse: Category group moderators can perform actions on topics in restricted categories without read accessEPSS 0.3%CVE-2025-65028MEDIUMRallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant VotesEPSS 0.3%CVE-2025-71242MEDIUMSPIP < 4.3.6 Authorization Bypass Leading to Content DisclosureEPSS 0.3%CVE-2026-55236MEDIUMlanggraph-api: Incomplete assistant authorization in LangGraph Server run creationEPSS 0.3%CVE-2026-48810MEDIUMFreeScout: Thread Edit Authorization Bypass via Missing Mailbox CheckEPSS 0.3%CVE-2026-16279CRITICALImproper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026xEPSS 0.3%CVE-2026-45147MEDIUMSiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to diskEPSS 0.3%CVE-2026-3237LOWIn affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiEPSS 0.3%CVE-2026-34321MEDIUMVulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comEPSS 0.3%CVE-2025-65031MEDIUMRallly Improper Authorization in Comment Endpoint Allows User ImpersonationEPSS 0.3%CVE-2026-47673MEDIUMHono: JWT middleware accepts any Authorization scheme, not only BearerEPSS 0.3%CVE-2024-23806MEDIUMHID Global Reader Configuration Cards Improper AuthorizationEPSS 0.3%CVE-2025-6431MEDIUMThe prompt in Firefox for Android that asks before opening a link in an external application could be bypassedEPSS 0.3%CVE-2022-2393—A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication isEPSS 0.3%CVE-2026-1894MEDIUMWeKan REST API checklistItems.js Checklist REST Bleed improper authorizationEPSS 0.3%CVE-2022-34405HIGHAn improper access control vulnerability was identified in the Realtek audio driver. A local authenticated malicious user may potentially exEPSS 0.3%CVE-2022-39873MEDIUMImproper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret modEPSS 0.2%CVE-2023-0837MEDIUMAn improper authorization check of local device settings in TeamViewer Remote between version 15.41 and 15.42.7 for Windows and macOS allowEPSS 0.2%CVE-2025-8147MEDIUMLWSCache <= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin FunctionEPSS 0.2%CVE-2026-24890HIGHOpenEMR Portal Users Can Forge Provider SignaturesEPSS 0.2%