Fallos del tipo CWE-862

10.152 resultados

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para isso. O código autentica (confirma quem é), mas não autoriza (verifica o que pode fazer). Resultado: qualquer autenticado pode fazer o que quiser — ler dados de outros usuários, deletar registros, alterar configurações.

Ejemplo

Uma API de banco de dados que autentica o cliente via token JWT, mas retorna qualquer registro solicitado sem checar se o usuário é dono do dado. Um usuário autenticado consegue consultar CPF, conta bancária e extrato de qualquer outro cliente apenas mudando um parâmetro ID na requisição.

Cómo mitigar

Implemente controle de acesso em cada operação sensível: antes de retornar um recurso, valide se o usuário autenticado tem permissão (via papel, proprietário, ou ACL). Use um padrão consistente — biblioteca de autorização, middleware ou serviço centralizado — para não deixar brechas espalhadas no código.

CVE-2019-3879MEDIUMIt was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the peEPSS 1.8%CVE-2024-12365HIGHW3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request ForgeryEPSS 1.8%CVE-2024-50967MEDIUMThe /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remEPSS 1.8%CVE-2026-24421MEDIUMphpMyFAQ missing authorization exposes /api/setup/backup to any authenticated userEPSS 1.7%CVE-2024-47308MEDIUMWordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerabilityEPSS 1.7%CVE-2024-10674HIGHTh Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/ActivationEPSS 1.7%CVE-2020-25718—A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This EPSS 1.7%CVE-2015-10140HIGHAjax Load More < 2.8.1.2 - Subscriber+ File Upload & DeletionEPSS 1.7%CVE-2026-40502HIGHOpenHarness Remote Administrative Command Injection via Gateway HandlerEPSS 1.7%CVE-2021-39232—Missing admin check for SCM related admin commandsEPSS 1.7%CVE-2017-7530HIGHIn CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitEPSS 1.7%CVE-2021-27859HIGHMissing authorization vulnerability in FatPipe softwareEPSS 1.7%CVE-2019-6580—A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), SivEPSS 1.7%CVE-2024-10629HIGHGPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File CreationEPSS 1.7%CVE-2023-7317CRITICALNagios XI < 2024R1 Web SSH Terminal Missing Access ControlEPSS 1.7%CVE-2021-27855HIGHFatPipe software allows privilege escalationEPSS 1.7%CVE-2026-11801HIGHWPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST EndpointEPSS 1.6%CVE-2026-27833HIGHPiwigo: Unauthenticated Information Disclosure via pwg.history.search APIEPSS 1.6%CVE-2024-54369CRITICALWordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerabilityEPSS 1.6%CVE-2026-18110HIGHConcrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, usernameEPSS 1.6%