Fallos del tipo CWE-862

9265 resultados

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para isso. O código autentica (confirma quem é), mas não autoriza (verifica o que pode fazer). Resultado: qualquer autenticado pode fazer o que quiser — ler dados de outros usuários, deletar registros, alterar configurações.

Ejemplo

Uma API de banco de dados que autentica o cliente via token JWT, mas retorna qualquer registro solicitado sem checar se o usuário é dono do dado. Um usuário autenticado consegue consultar CPF, conta bancária e extrato de qualquer outro cliente apenas mudando um parâmetro ID na requisição.

Cómo mitigar

Implemente controle de acesso em cada operação sensível: antes de retornar um recurso, valide se o usuário autenticado tem permissão (via papel, proprietário, ou ACL). Use um padrão consistente — biblioteca de autorização, middleware ou serviço centralizado — para não deixar brechas espalhadas no código.

CVE-2026-91023LOWMotors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featuredEPSS 0.1%CVE-2026-87069LOWForminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripeEPSS 0.1%CVE-2024-0038HIGHIn injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing pEPSS 0.1%CVE-2026-33776MEDIUMJunos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive informationEPSS 0.1%CVE-2026-93507LOWWC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content DisclosureEPSS 0.1%CVE-2022-39093HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2022-42776HIGHIn UscAIEngine service, there is a missing permission check. This could lead to set up UscAIEngine service with no additional execution privEPSS 0.1%CVE-2022-42777HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.1%CVE-2022-42778HIGHIn windows manager service, there is a missing permission check. This could lead to set up windows manager service with no additional executEPSS 0.1%CVE-2024-42035HIGHPermission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality EPSS 0.1%CVE-2026-7328MEDIUMUnverified AXI Address in Subsystem Mode Commands Enables Denial of ServiceEPSS 0.1%CVE-2023-21244MEDIUMIn visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead EPSS 0.1%CVE-2023-52713HIGHVulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affEPSS 0.1%CVE-2025-0086MEDIUMIn onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could leaEPSS 0.1%CVE-2026-47552HIGHNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorizatiEPSS 0.1%CVE-2026-53996HIGHNetBSD hdaudio(4) Driver Privilege Bypass Use-After-Free via HDAUDIO_FGRP_SETCONFIG ioctlEPSS 0.1%CVE-2022-39103MEDIUMIn Gallery service, there is a missing permission check. This could lead to local denial of service in Gallery service with no additional exEPSS 0.1%CVE-2023-20916HIGHIn getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from tEPSS 0.1%CVE-2026-11858HIGHMissing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEMEPSS 0.1%CVE-2023-20912HIGHIn onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permissEPSS 0.1%