Fallos del tipo CWE-862

9264 resultados

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para isso. O código autentica (confirma quem é), mas não autoriza (verifica o que pode fazer). Resultado: qualquer autenticado pode fazer o que quiser — ler dados de outros usuários, deletar registros, alterar configurações.

Ejemplo

Uma API de banco de dados que autentica o cliente via token JWT, mas retorna qualquer registro solicitado sem checar se o usuário é dono do dado. Um usuário autenticado consegue consultar CPF, conta bancária e extrato de qualquer outro cliente apenas mudando um parâmetro ID na requisição.

Cómo mitigar

Implemente controle de acesso em cada operação sensível: antes de retornar um recurso, valide se o usuário autenticado tem permissão (via papel, proprietário, ou ACL). Use um padrão consistente — biblioteca de autorização, middleware ou serviço centralizado — para não deixar brechas espalhadas no código.

CVE-2026-109696MEDIUMWordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-6509HIGHPrivilege Escalation in TUBITAK BILGEM's Pardus UpdateEPSS 0.1%CVE-2026-100593MEDIUMOpenClaw before 2026.7.1 Authentication Bypass via activationEPSS 0.1%CVE-2026-84569MEDIUMAn access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Golden Gate 27. AEPSS 0.1%CVE-2023-21133MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2023-20926MEDIUMIn onParentVisible of HeaderPrivacyIconsController.kt, there is a possible way to bypass factory reset protections due to a missing permissiEPSS 0.1%CVE-2026-16965MEDIUMSolace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_statusEPSS 0.1%CVE-2026-91009MEDIUMActive Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachmentEPSS 0.1%CVE-2026-13414MEDIUMCMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajaxEPSS 0.1%CVE-2023-21140MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2026-15246MEDIUMRealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment BypassEPSS 0.1%CVE-2026-9771HIGHMissing device-pointer validation in flash_copy() syscall allows userspace privilege escalationEPSS 0.1%CVE-2023-21132MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2023-21134MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2022-38678MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional EPSS 0.1%CVE-2022-38684MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional EPSS 0.1%CVE-2022-38682MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional EPSS 0.1%CVE-2022-38683MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional EPSS 0.1%CVE-2022-39104MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in Contacts service with no additional EPSS 0.1%CVE-2026-84551MEDIUMA logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOEPSS 0.1%