Weaknesses of type CWE-862

9,268 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-87069LOWForminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripeEPSS 0.1%CVE-2024-0038HIGHIn injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing pEPSS 0.1%CVE-2026-91023LOWMotors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featuredEPSS 0.1%CVE-2026-93507LOWWC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content DisclosureEPSS 0.1%CVE-2026-33776MEDIUMJunos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive informationEPSS 0.1%CVE-2024-42035HIGHPermission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality EPSS 0.1%CVE-2022-39093HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2022-42776HIGHIn UscAIEngine service, there is a missing permission check. This could lead to set up UscAIEngine service with no additional execution privEPSS 0.1%CVE-2022-42778HIGHIn windows manager service, there is a missing permission check. This could lead to set up windows manager service with no additional executEPSS 0.1%CVE-2022-42777HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2026-7328MEDIUMUnverified AXI Address in Subsystem Mode Commands Enables Denial of ServiceEPSS 0.1%CVE-2026-47552HIGHNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorizatiEPSS 0.1%CVE-2023-21244MEDIUMIn visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead EPSS 0.1%CVE-2025-0086MEDIUMIn onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could leaEPSS 0.1%CVE-2023-52713HIGHVulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affEPSS 0.1%CVE-2026-53996HIGHNetBSD hdaudio(4) Driver Privilege Bypass Use-After-Free via HDAUDIO_FGRP_SETCONFIG ioctlEPSS 0.1%CVE-2022-39103MEDIUMIn Gallery service, there is a missing permission check. This could lead to local denial of service in Gallery service with no additional exEPSS 0.1%CVE-2026-11858HIGHMissing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEMEPSS 0.1%CVE-2023-20916HIGHIn getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from tEPSS 0.1%CVE-2023-20912HIGHIn onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permissEPSS 0.1%