Weaknesses of type CWE-862

9,277 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-46586MEDIUMPermission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-48578HIGHIn multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permisEPSS 0.1%CVE-2023-21341HIGHIn Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This could lead to local esEPSS 0.1%CVE-2026-58068MEDIUMThis vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.EPSS 0.1%CVE-2026-108851MEDIUMphpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search ToolEPSS 0.1%CVE-2025-48574HIGHIn validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permiEPSS 0.1%CVE-2026-47603MEDIUMNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another proEPSS 0.1%CVE-2022-47341MEDIUMIn engineermode services, there is a missing permission check. This could lead to local escalation of privilege with system execution privilEPSS 0.1%CVE-2026-95835MEDIUMMissing ownership check on the shared memory object named by the kitty askpass escape codeEPSS 0.1%CVE-2026-47604MEDIUMNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another proEPSS 0.1%CVE-2022-39119—In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution priviEPSS 0.1%CVE-2026-86819HIGHWaves Central local privilege escalation via Improper XPC Client Authentication in macOSEPSS 0.1%CVE-2023-35677—In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could leaEPSS 0.1%CVE-2025-48634HIGHIn relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. This could lead to locEPSS 0.1%CVE-2026-55628MEDIUMImageMagick: Policy Bypass in concatenate operation due to missing checksEPSS 0.1%CVE-2023-42688HIGHIn wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2026-0026HIGHIn removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error inEPSS 0.1%CVE-2023-42694HIGHIn wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2023-42681HIGHIn ion service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution EPSS 0.1%CVE-2026-13159MEDIUMReal Estate Papi <= 1.0.5 - Subscriber+ Plugin InstallationEPSS 0.1%