Weaknesses of type CWE-306

2,599 results

Ausência de autenticação em funcionalidades críticas

A aplicação oferece funcionalidades sensíveis ou que consomem recursos significativos (processamento pesado, armazenamento, transações) sem verificar a identidade do usuário. Qualquer pessoa, autenticada ou não, consegue acessar e executar essas operações, comprometendo confidencialidade, integridade e disponibilidade.

Example

Um serviço de geração de relatórios expõe um endpoint `/api/gerar-relatorio` que não valida token JWT ou sessão — um atacante consegue disparar dezenas de requisições simultâneas, sobrecarregando o servidor, ou acessar dados de outros clientes sem se identificar.

How to mitigate

Implemente autenticação obrigatória antes de qualquer operação sensível (valide token, sessão ou credenciais). Para APIs, use OAuth2/JWT com verificação no início da requisição; para aplicações web, enforce sessão válida. Combine com rate limiting e quotas por usuário para conter abuso de recursos.

CVE-2023-28697CRITICALMoxa MiiNePort E1 - Broken Access ControlEPSS 0.9%CVE-2020-14479MEDIUMICSA-20-147-01 Inductive Automation Ignition (Update B)EPSS 0.9%CVE-2023-38028CRITICALSaho ADM100&ADM-100FP - Broken Access ControlEPSS 0.9%CVE-2025-27642CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Unauthenticated Driver Package EditEPSS 0.9%CVE-2026-23751CRITICALKofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET RemotingEPSS 0.9%CVE-2022-47377CRITICALPassword recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker toEPSS 0.9%CVE-2024-21619MEDIUMJunos OS: SRX Series and EX Series: J-Web - unauthenticated access to temporary files containing sensitive informationEPSS 0.9%CVE-2023-27980HIGHA CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation EPSS 0.9%CVE-2026-6847CRITICALUnauthenticated Remote Code Execution in ThemisNETPanelEPSS 0.9%CVE-2025-69425CRITICALRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCEEPSS 0.9%CVE-2022-4018MEDIUMMissing Authentication for Critical Function in ikus060/rdiffwebEPSS 0.9%CVE-2026-25593HIGHOpenClaw Affected by Unauthenticated Local RCE via WebSocket config.applyEPSS 0.9%CVE-2026-49827CRITICALWebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)EPSS 0.9%CVE-2022-43989HIGHPassword recovery vulnerability in SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 with firmware version < 1.2.0 allows an unprivileged reEPSS 0.9%CVE-2022-43990HIGHPassword recovery vulnerability in SICK SIM1012 Partnumber 1098146 with firmware version <2.2.0 allows an unprivileged remote attacker to gaEPSS 0.9%CVE-2026-67593CRITICALApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletionEPSS 0.9%CVE-2024-14007HIGHTVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information DisclosureEPSS 0.9%CVE-2026-71878CRITICALAuthentication bypass in Integrated Publishing ToolkitEPSS 0.9%CVE-2025-6916HIGHTOTOLINK T6 formLoginAuth.htm Form_Login missing authenticationEPSS 0.9%CVE-2020-23256CRITICALAn issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.EPSS 0.9%