Fallos del tipo CWE-862

9259 resultados

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para isso. O código autentica (confirma quem é), mas não autoriza (verifica o que pode fazer). Resultado: qualquer autenticado pode fazer o que quiser — ler dados de outros usuários, deletar registros, alterar configurações.

Ejemplo

Uma API de banco de dados que autentica o cliente via token JWT, mas retorna qualquer registro solicitado sem checar se o usuário é dono do dado. Um usuário autenticado consegue consultar CPF, conta bancária e extrato de qualquer outro cliente apenas mudando um parâmetro ID na requisição.

Cómo mitigar

Implemente controle de acesso em cada operação sensível: antes de retornar um recurso, valide se o usuário autenticado tem permissão (via papel, proprietário, ou ACL). Use um padrão consistente — biblioteca de autorização, middleware ou serviço centralizado — para não deixar brechas espalhadas no código.

CVE-2022-20519LOWIn onCreate of AddAppNetworksActivity.java, there is a possible way for a guest user to configure WiFi networks due to a missing permission EPSS 0.2%CVE-2026-10787MEDIUMMissing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadataEPSS 0.2%CVE-2026-12631MEDIUMBroken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernelEPSS 0.2%CVE-2024-33685MEDIUMWordPress Startupzy theme <= 1.1.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-24520MEDIUMWordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-0071CRITICALIn SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilEPSS 0.2%CVE-2026-15178MEDIUMFluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and ModificationEPSS 0.2%CVE-2026-86897MEDIUMThis issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 2EPSS 0.2%CVE-2026-87074LOWForminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled LinkEPSS 0.2%CVE-2022-39101HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2026-10855MEDIUMMISP Event template importer authorization bypassEPSS 0.2%CVE-2022-39094HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2022-39102HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2026-19197MEDIUMBroken access control in dashboard snapshotsEPSS 0.2%CVE-2022-39096HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2022-39100HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2022-39095HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2022-39099HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2026-43689HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOSEPSS 0.2%CVE-2025-43497MEDIUMAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break outEPSS 0.2%