Weaknesses of type CWE-841

91 results

Falta de Aplicação de Fluxo de Comportamento

Ocorre quando a aplicação não valida ou não força a ordem correta de operações que deveriam seguir um fluxo pré-definido. Um usuário pode pular etapas, executar ações fora da sequência esperada ou contornar regras de negócio, alterando o estado do sistema de forma indevida.

Example

Um sistema de compras que deveria exigir: (1) adicionar item ao carrinho, (2) informar endereço, (3) selecionar pagamento, (4) confirmar pedido. Se a aplicação não valida essas etapas no servidor, um atacante pode enviar uma requisição direto à etapa (4) sem passar pelas anteriores, criando pedidos sem endereço ou com valores manipulados.

How to mitigate

Implemente validação de estado no servidor: cada operação deve verificar se o usuário está na etapa correta antes de prosseguir. Use máquinas de estado (finite state machines) para modelar transições permitidas e rejeite requisições que violem o fluxo esperado. Nunca confie na ordem de execução do lado cliente.

CVE-2026-42303MEDIUMFides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate DetectionEPSS 0.3%CVE-2026-48505HIGHFilament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submissionEPSS 0.3%CVE-2026-48974MEDIUMHomeBox: Forced Group Membership Without Consent in Homebox AddMember HandlerEPSS 0.3%CVE-2025-36333MEDIUMVulnerabilities found in Watson Data IntelligenceEPSS 0.3%CVE-2026-87503MEDIUMInappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social EPSS 0.3%CVE-2023-1383MEDIUMAn Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attaEPSS 0.3%CVE-2026-30574HIGHA Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file. The application faEPSS 0.3%CVE-2026-46540MEDIUMNimiq light-blockchain: Light blockchain rebranch issueEPSS 0.3%CVE-2026-77508LOWWeblate: Unverified REST API email changesEPSS 0.3%CVE-2025-48376LOWDnn.Platform's Site Import could use an external source with a crafted requestEPSS 0.3%CVE-2026-115248MEDIUMsubhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflowEPSS 0.3%CVE-2026-8477LOWImproper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticateEPSS 0.2%CVE-2023-5921HIGHFunction Bypass in GeodiEPSS 0.2%CVE-2026-95369HIGHInappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code EPSS 0.2%CVE-2026-15365LOWA pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.EPSS 0.2%CVE-2026-34582HIGHBotan has a TLS 1.3 certificate authentication bypassEPSS 0.2%CVE-2026-24774MEDIUMOpen eClass Business Logic Flaw Allows Students to Mark Attendance in Expired ActivitiesEPSS 0.2%CVE-2024-44128MEDIUMThis issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS EPSS 0.2%CVE-2026-19878MEDIUMSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.2%CVE-2022-46710MEDIUMA logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be EPSS 0.2%