Weaknesses of type CWE-807

137 results

Decisão de segurança baseada em entrada não confiável

A aplicação toma decisões críticas de segurança (autenticação, autorização, controle de acesso) usando dados que vêm diretamente do usuário ou cliente sem validação adequada. Um atacante pode manipular esses dados para contornar controles de segurança e ganhar acesso não autorizado.

Example

Um sistema que verifica permissão de admin apenas consultando um campo 'isAdmin' vindo do formulário POST do cliente, ou que valida um JWT usando um secret armazenado no cookie do próprio usuário. Um atacante edita o valor local e a aplicação confia cegamente.

How to mitigate

Nunca confie em dados do cliente para decisões de segurança: sempre valide e recalcule permissões no servidor usando fonte confiável (banco de dados, sessão segura, token assinado com chave servidor). Implemente verificação de autorização em cada endpoint sensível, independentemente do que o cliente envie.

CVE-2024-7005HIGHInsufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced EPSS 0.5%CVE-2026-94606HIGHauthentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStageEPSS 0.5%CVE-2025-59152HIGHX-Forwarded-For Header Spoofing Bypasses Litestar Rate LimitingEPSS 0.5%CVE-2024-52327MEDIUMECOVACS lawnmower and vacuum cloud service live video PIN bypassEPSS 0.5%CVE-2026-81179HIGHSysReptor: Host header injection might allow account takeoverEPSS 0.5%CVE-2025-66507HIGH1Panel – CAPTCHA Bypass via Client-Controlled FlagEPSS 0.5%CVE-2026-79700MEDIUMJoomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0EPSS 0.5%CVE-2026-79701MEDIUMJoomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0EPSS 0.5%CVE-2026-88004HIGHTraefik entrypoint header-name sanitization bypassed via request trailersEPSS 0.5%CVE-2025-13926CRITICALContemporary Controls BASC 20T Reliance on Untrusted Inputs in a Security DecisionEPSS 0.5%CVE-2026-88210HIGHMicrosoft Office Word Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-9077HIGHReliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol featuresEPSS 0.4%CVE-2025-24369LOWAnubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0EPSS 0.4%CVE-2026-108433HIGHMicrosoft Office Word Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-87479HIGHInsufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rendEPSS 0.4%CVE-2026-76147MEDIUMGenians, Inc Genian NAC/ZTNA Remote Code ExecutionEPSS 0.4%CVE-2026-16093MEDIUMKeycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headersEPSS 0.4%CVE-2026-111748MEDIUMAIOHTTP: Absolute-form request targets can spoof Request.schemeEPSS 0.4%CVE-2026-13059HIGHImproper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control BypassEPSS 0.4%CVE-2026-25958HIGHCube privilege escalation via a specially crafted requestEPSS 0.4%