Weaknesses of type CWE-285

1,605 results

Falha na verificação de autorização

A aplicação não valida ou valida incorretamente se um usuário tem permissão para acessar um recurso ou executar uma ação. O código assume que autenticação (saber quem é) é suficiente, ignorando autorização (saber o que pode fazer), permitindo que usuários acessem dados ou façam operações que não deveriam.

Example

Um usuário comum consegue listar faturas de outro cliente porque a API verifica se ele está logado, mas não valida se aquela fatura pertence a ele. Ou um analista consegue executar uma exclusão em massa porque o botão existe no HTML, mas o backend não checa se ele tem permissão de admin.

How to mitigate

Implemente verificações de autorização em toda operação sensível: antes de retornar dados, valide se o usuário autenticado tem acesso àquele recurso específico (RBAC, ABAC ou ACL). Teste permissões no backend sempre, nunca confie em controles apenas na UI.

CVE-2024-42036LOWAccess permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service EPSS 0.1%CVE-2023-28973HIGHJunos OS Evolved: The 'sysmanctl' shell command allows a local user to gain access to some administrative actions EPSS 0.1%CVE-2026-3671MEDIUMFreedom Factory dGEN1 org.ethereumphone.walletmanager.testing123 TokenBalanceContentProvider improper authorizationEPSS 0.1%CVE-2026-84621MEDIUMAn authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, maEPSS 0.1%CVE-2026-84615MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, EPSS 0.1%CVE-2026-17433MEDIUMnanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorizationEPSS 0.1%CVE-2023-21461MEDIUMImproper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows local attacker to turEPSS 0.1%CVE-2026-3674MEDIUMFreedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppProvider improper authorizationEPSS 0.1%CVE-2026-3669MEDIUMFreedom Factory dGEN1 com.dgen.alarm AlarmService improper authorizationEPSS 0.1%CVE-2026-3670MEDIUMFreedom Factory dGEN1 com.dgen.alarm improper authorizationEPSS 0.1%CVE-2026-3667MEDIUMFreedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppService improper authorizationEPSS 0.1%CVE-2026-3675MEDIUMFreedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppReceiver improper authorizationEPSS 0.1%CVE-2022-36857LOWImproper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows physical attackers to read internal application EPSS 0.1%CVE-2026-28845MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.4. An app may be able to access pEPSS 0.1%CVE-2022-45874MEDIUMHuawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain filEPSS 0.1%CVE-2023-41819MEDIUM A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local attacker to access unEPSS 0.1%CVE-2026-84556MEDIUMAn authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS TaEPSS 0.1%CVE-2026-65353MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6. An aEPSS 0.1%CVE-2026-84636MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watcEPSS 0.1%CVE-2026-43695MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOEPSS 0.1%