Weaknesses of type CWE-862

9,272 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-31171MEDIUMFile read permission bypass vulnerability in the kernel file system module Impact: Successful exploitation of this vulnerability may affect EPSS 0.1%CVE-2022-20446LOWIn AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the background due to a miEPSS 0.1%CVE-2026-79286HIGHMissing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arEPSS 0.1%CVE-2023-21002HIGHIn getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission checEPSS 0.1%CVE-2024-5899LOWImproper trust check in Bazel Build intellij pluginEPSS 0.1%CVE-2026-20535MEDIUMIn aidl, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if EPSS 0.1%CVE-2021-0641MEDIUMIn getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing peEPSS 0.1%CVE-2026-26103HIGHUdisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus apiEPSS 0.1%CVE-2026-100573MEDIUMOpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP LoopbackEPSS 0.1%CVE-2026-104660HIGHMissing Authorization in hMailServerEPSS 0.1%CVE-2022-20451HIGHIn onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission check. This could leadEPSS 0.1%CVE-2024-51516MEDIUMPermission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to function EPSS 0.1%CVE-2026-104117LOWMissing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membershipEPSS 0.1%CVE-2026-104116LOWMissing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zonesEPSS 0.1%CVE-2025-48614MEDIUMIn rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permissEPSS 0.1%CVE-2026-79086MEDIUMMissing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain sensitive inforEPSS 0.1%CVE-2026-71317MEDIUMLemur: Sub-CA creation never checks `AuthorityPermission` on the parent authorityEPSS 0.1%CVE-2026-26104MEDIUMUdisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus apiEPSS 0.1%CVE-2025-48578HIGHIn multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permisEPSS 0.1%CVE-2025-46586MEDIUMPermission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%