Weaknesses of type CWE-807

137 results

Decisão de segurança baseada em entrada não confiável

A aplicação toma decisões críticas de segurança (autenticação, autorização, controle de acesso) usando dados que vêm diretamente do usuário ou cliente sem validação adequada. Um atacante pode manipular esses dados para contornar controles de segurança e ganhar acesso não autorizado.

Example

Um sistema que verifica permissão de admin apenas consultando um campo 'isAdmin' vindo do formulário POST do cliente, ou que valida um JWT usando um secret armazenado no cookie do próprio usuário. Um atacante edita o valor local e a aplicação confia cegamente.

How to mitigate

Nunca confie em dados do cliente para decisões de segurança: sempre valide e recalcule permissões no servidor usando fonte confiável (banco de dados, sessão segura, token assinado com chave servidor). Implemente verificação de autorização em cada endpoint sensível, independentemente do que o cliente envie.

CVE-2026-84474CRITICALAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host matchEPSS 0.8%CVE-2026-87858HIGHTemporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorizationEPSS 0.8%CVE-2026-85817HIGHMicrosoft PowerShell Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-12487CRITICALoobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-12488CRITICALoobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-96251HIGHMicrosoft PowerShell Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-63041MEDIUMApache APISIX: attach-consumer-label does not strip client-supplied consumer-label headersEPSS 0.7%CVE-2026-54730HIGHauthentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageViewEPSS 0.7%CVE-2026-66768CRITICALImproper Access Control in SAP NetWeaver (SAP GUI for Java)EPSS 0.6%CVE-2026-59157MEDIUMwebhookd: Unrestricted HTTP Header to Shell Variable InjectionEPSS 0.6%CVE-2026-86863CRITICALpgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication modeEPSS 0.6%CVE-2026-27707HIGHPlex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpointEPSS 0.6%CVE-2026-85751CRITICALMailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trustEPSS 0.6%CVE-2026-31892HIGHWorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference ModeEPSS 0.6%CVE-2026-39807MEDIUMClient-supplied URI scheme trusted without transport verification in banditEPSS 0.5%CVE-2024-51561CRITICALAuthentication bypass Vulnerability in AeroEPSS 0.5%CVE-2026-111869MEDIUMmakeplane API Endpoint reliance on untrusted inputs in a security decisionEPSS 0.5%CVE-2023-46686MEDIUM A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre DiaEPSS 0.5%CVE-2026-56682MEDIUM9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip HeaderEPSS 0.5%CVE-2024-21510MEDIUMVersions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XEPSS 0.5%