Fallos del tipo CWE-862

8581 resultados

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para isso. O código autentica (confirma quem é), mas não autoriza (verifica o que pode fazer). Resultado: qualquer autenticado pode fazer o que quiser — ler dados de outros usuários, deletar registros, alterar configurações.

Ejemplo

Uma API de banco de dados que autentica o cliente via token JWT, mas retorna qualquer registro solicitado sem checar se o usuário é dono do dado. Um usuário autenticado consegue consultar CPF, conta bancária e extrato de qualquer outro cliente apenas mudando um parâmetro ID na requisição.

Cómo mitigar

Implemente controle de acesso em cada operação sensível: antes de retornar um recurso, valide se o usuário autenticado tem permissão (via papel, proprietário, ou ACL). Use um padrão consistente — biblioteca de autorização, middleware ou serviço centralizado — para não deixar brechas espalhadas no código.

CVE-2026-44482CRITICALsoundcloud-rpc: Remote Code Execution via XSS in Track TitleEPSS 0.6%CVE-2021-33704MEDIUMThe Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be EPSS 0.6%CVE-2026-92761HIGHWebVirtCloud Missing Authorization on Instance Control ActionsEPSS 0.6%CVE-2021-32504—Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious aEPSS 0.6%CVE-2024-3607MEDIUMPropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post DeletionEPSS 0.6%CVE-2023-35049HIGHWordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-48127MEDIUMFrappe: Arbitrary Attachment Injection via add_attachments and upload_fileEPSS 0.6%CVE-2025-12825MEDIUMUser Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information ExposureEPSS 0.6%CVE-2026-33638MEDIUMEch0 authenticated user-list exposed data via public `/api/allusers` endpointEPSS 0.6%CVE-2024-3750HIGHVisualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL ExecutionEPSS 0.6%CVE-2026-3431CRITICALSim Studio AI - MongoDB SSRF and Arbitrary Document DeletionEPSS 0.6%CVE-2026-17613HIGHCVE-2026-17613EPSS 0.6%CVE-2026-9178HIGHWP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST EndpointEPSS 0.6%CVE-2024-11334MEDIUMMy Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV ExportEPSS 0.6%CVE-2026-39397CRITICAL@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collectionsEPSS 0.6%CVE-2022-43417MEDIUMJenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/ReadEPSS 0.6%CVE-2025-10896HIGHMultiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin UploadEPSS 0.6%CVE-2023-27701HIGHMuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /database/sqldel.html.EPSS 0.6%CVE-2024-38002CRITICALThe workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, EPSS 0.6%CVE-2026-55638HIGH9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypassEPSS 0.6%