Weaknesses of type CWE-285

1,605 results

Falha na verificação de autorização

A aplicação não valida ou valida incorretamente se um usuário tem permissão para acessar um recurso ou executar uma ação. O código assume que autenticação (saber quem é) é suficiente, ignorando autorização (saber o que pode fazer), permitindo que usuários acessem dados ou façam operações que não deveriam.

Example

Um usuário comum consegue listar faturas de outro cliente porque a API verifica se ele está logado, mas não valida se aquela fatura pertence a ele. Ou um analista consegue executar uma exclusão em massa porque o botão existe no HTML, mas o backend não checa se ele tem permissão de admin.

How to mitigate

Implemente verificações de autorização em toda operação sensível: antes de retornar dados, valide se o usuário autenticado tem acesso àquele recurso específico (RBAC, ABAC ou ACL). Teste permissões no backend sempre, nunca confie em controles apenas na UI.

CVE-2021-25433—Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications tEPSS 0.2%CVE-2025-12505MEDIUMweDocs <= 2.1.14 - Missing Authorization to Settings UpdateEPSS 0.2%CVE-2026-28881MEDIUMA privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive userEPSS 0.2%CVE-2026-10294MEDIUMPackageKit API pk-transaction.c g_file_test improper authorizationEPSS 0.2%CVE-2020-1690—An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a containerEPSS 0.2%CVE-2025-9294MEDIUMQuiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results DeletionEPSS 0.2%CVE-2024-24900MEDIUMDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. An adjacent network low priEPSS 0.2%CVE-2026-83805MEDIUMNautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobsEPSS 0.2%CVE-2022-31609HIGHNVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows the guest VM to allocate resources fEPSS 0.2%CVE-2025-12367MEDIUMSiteSEO – SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings UpdateEPSS 0.2%CVE-2025-2850MEDIUMGL.iNet GL-A1300 Slate Plus Download Interface improper authorizationEPSS 0.2%CVE-2025-12360MEDIUMBetter Find and Replace <= 1.7.7 - Missing AuthorizationEPSS 0.2%CVE-2026-5283MEDIUMInappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a craEPSS 0.2%CVE-2026-10070MEDIUMmacrozheng mall Super Admin Password update improper authorizationEPSS 0.2%CVE-2026-23623MEDIUMCollabora Online vulnerable to Authorization BypassEPSS 0.2%CVE-2025-32964MEDIUMManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensionsEPSS 0.2%CVE-2021-25499HIGHIntent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access contEPSS 0.2%CVE-2022-3787HIGHA vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alEPSS 0.2%CVE-2021-25399—Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege.EPSS 0.2%CVE-2023-38135MEDIUMImproper authorization in some Intel(R) PM software may allow a privileged user to potentially enable escalation of privilege via local acceEPSS 0.2%