Fallos del tipo CWE-288

747 resultados

Controle de acesso inadequado

A aplicação falha em validar corretamente se um usuário tem permissão para executar uma ação ou acessar um recurso específico. Sem essa validação, um atacante consegue contornar restrições e executar operações que deveria estar proibido (ler dados sensíveis, modificar registros de outros usuários, acessar áreas administrativas, etc.).

Ejemplo

Um sistema bancário permite que qualquer usuário autenticado mude a senha de qualquer outra conta apenas alterando o ID de usuário na requisição, sem verificar se aquele usuário é realmente o dono da conta ou um administrador autorizado.

Cómo mitigar

Implemente verificações de autorização em toda requisição sensível: valide se o usuário logado é realmente quem deveria estar fazendo aquela ação (propriedade, role, permissão explícita). Centralize essa lógica em um componente de controle de acesso reutilizável e teste-a sistematicamente com usuários de diferentes perfis.

CVE-2025-13013MEDIUMMitigation bypass in the DOM: Core & HTML componentEPSS 0.2%CVE-2025-67282MEDIUMIn TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download EPSS 0.2%CVE-2024-52586MEDIUMeLabFTW MFA bypassEPSS 0.2%CVE-2025-24332HIGHAuthenticated admin user can connect baseband internally from one board to another without needing to re-authenticationEPSS 0.2%CVE-2025-12760MEDIUMEmail TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115EPSS 0.2%CVE-2026-1917MEDIUMLogin Disable - Less critical - Access bypass - SA-CONTRIB-2026-008EPSS 0.2%CVE-2025-43422MEDIUMThe issue was addressed by adding additional logic. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker with physical access to a dEPSS 0.2%CVE-2025-6556MEDIUMInsufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policEPSS 0.2%CVE-2026-8990MEDIUMAuthentication Bypass in KidsviewEPSS 0.2%CVE-2026-42654HIGHWordPress Wallet System for WooCommerce plugin <= 2.7.5 - Broken Authentication vulnerabilityEPSS 0.2%CVE-2021-33700HIGHSAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the vEPSS 0.2%CVE-2025-46286MEDIUMA logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS 26.2. Restoring from a backup may prevent pEPSS 0.2%CVE-2024-31463MEDIUMIronic-image allows unauthenticated local access to Ironic APIEPSS 0.2%CVE-2026-32031MEDIUMOpenClaw < 2026.2.26 - Authentication Bypass via Path Canonicalization Mismatch in /api/channels GatewayEPSS 0.2%CVE-2026-35642MEDIUMOpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention BypassEPSS 0.2%CVE-2022-42275HIGHNVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a losEPSS 0.2%CVE-2024-42178LOWHCL MyXalytics is affected by a failure to restrict URL access vulnerabilityEPSS 0.2%CVE-2024-7125HIGHAuthentication Bypass Vulnerability in Hitachi Ops Center Common ServicesEPSS 0.2%CVE-2026-89057HIGHA potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unaEPSS 0.2%CVE-2024-35214HIGHVulnerability in CylanceOPTICS Windows Installer Package Impacts CylanceOPTICS for WindowsEPSS 0.2%