Fallos del tipo CWE-288

747 resultados

Controle de acesso inadequado

A aplicação falha em validar corretamente se um usuário tem permissão para executar uma ação ou acessar um recurso específico. Sem essa validação, um atacante consegue contornar restrições e executar operações que deveria estar proibido (ler dados sensíveis, modificar registros de outros usuários, acessar áreas administrativas, etc.).

Ejemplo

Um sistema bancário permite que qualquer usuário autenticado mude a senha de qualquer outra conta apenas alterando o ID de usuário na requisição, sem verificar se aquele usuário é realmente o dono da conta ou um administrador autorizado.

Cómo mitigar

Implemente verificações de autorização em toda requisição sensível: valide se o usuário logado é realmente quem deveria estar fazendo aquela ação (propriedade, role, permissão explícita). Centralize essa lógica em um componente de controle de acesso reutilizável e teste-a sistematicamente com usuários de diferentes perfis.

CVE-2026-30777MEDIUMEC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a validEPSS 0.4%CVE-2026-40785HIGHWordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerabilityEPSS 0.4%CVE-2026-114732MEDIUMRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. EPSS 0.4%CVE-2026-16647MEDIUMDisable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111EPSS 0.4%CVE-2026-78259HIGHWordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerabilityEPSS 0.4%CVE-2026-3605HIGHVault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-ServiceEPSS 0.4%CVE-2026-22733HIGHAuthentication Bypass under Actuator CloudFoundry endpointsEPSS 0.4%CVE-2026-39385HIGHFrappe LMS enrollment bypass in paid courses via unrelated batchEPSS 0.4%CVE-2023-42771HIGHAuthentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a netEPSS 0.4%CVE-2026-1241HIGHAuthentication Bypass Using an Alternate Path or Channel in Pelco, Inc. Sarix Pro 3 Series IP CamerasEPSS 0.4%CVE-2026-21411HIGHAuthentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator autheEPSS 0.4%CVE-2026-52848CRITICALGLPI: MFA bypassEPSS 0.4%CVE-2025-34520HIGHArcserve UDP < 10.2 Authentication BypassEPSS 0.4%CVE-2024-9658HIGHSchool Management System for Wordpress <= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege EscalationEPSS 0.4%CVE-2026-32678HIGHAuthentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings wiEPSS 0.4%CVE-2025-67070HIGHA vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the multi-EPSS 0.4%CVE-2025-24496HIGHAn information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafteEPSS 0.4%CVE-2026-5557MEDIUMbadlogic pi-mono pi-mom Slack Bot slack.ts authentication bypassEPSS 0.4%CVE-2025-66238HIGHSunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or ChannelEPSS 0.4%CVE-2026-27611HIGHFileBrowser Quantum: Password Protection Not Enforced on Shared File LinksEPSS 0.4%