Fallos del tipo CWE-862

8513 resultados

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para isso. O código autentica (confirma quem é), mas não autoriza (verifica o que pode fazer). Resultado: qualquer autenticado pode fazer o que quiser — ler dados de outros usuários, deletar registros, alterar configurações.

Ejemplo

Uma API de banco de dados que autentica o cliente via token JWT, mas retorna qualquer registro solicitado sem checar se o usuário é dono do dado. Um usuário autenticado consegue consultar CPF, conta bancária e extrato de qualquer outro cliente apenas mudando um parâmetro ID na requisição.

Cómo mitigar

Implemente controle de acesso em cada operação sensível: antes de retornar um recurso, valide se o usuário autenticado tem permissão (via papel, proprietário, ou ACL). Use um padrão consistente — biblioteca de autorização, middleware ou serviço centralizado — para não deixar brechas espalhadas no código.

CVE-2024-11423HIGHUltimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money GlitchEPSS 0.8%CVE-2024-43222CRITICALWordPress Sweet Date theme <= 3.7.3 - Privilege Escalation vulnerabilityEPSS 0.8%CVE-2022-36340MEDIUMWordPress MailOptin plugin <= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion vulnerabilityEPSS 0.8%CVE-2024-13513CRITICALOliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege EscalationEPSS 0.8%CVE-2023-22736HIGHargo-cd Controller reconciles apps outside configured namespaces when sharding is enabledEPSS 0.8%CVE-2022-36024HIGHBots using py-cord as discord api wrapper are vulnerable to shutdowns through remote code executionEPSS 0.8%CVE-2026-69724HIGHMicrosoft Office SharePoint Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-83941CRITICALEntra ID Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-41871CRITICALApache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)EPSS 0.8%CVE-2026-54569CRITICALSENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.coreEPSS 0.8%CVE-2024-7258HIGHWooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File DeletionEPSS 0.8%CVE-2021-32472—Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.EPSS 0.8%CVE-2022-31595—SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalatiEPSS 0.8%CVE-2026-41869CRITICALApache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)EPSS 0.8%CVE-2023-24438MEDIUMA missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permisEPSS 0.8%CVE-2023-24433MEDIUMMissing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to aEPSS 0.8%CVE-2026-40375MEDIUMMicrosoft Dynamics Business Central Information Disclosure VulnerabilityEPSS 0.8%CVE-2024-12544HIGHSurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS_DeleteFileEPSS 0.8%CVE-2023-49742CRITICALWordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerabilityEPSS 0.8%CVE-2026-50006CRITICALAnyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server ModeEPSS 0.8%