Fallos del tipo CWE-863

3088 resultados

Falha na verificação de autorização

O software implementa uma verificação de acesso, mas a lógica está incorreta ou incompleta, permitindo que um usuário acesse recursos ou execute ações que não deveria. O risco é grave porque a autenticação (você é quem diz ser) pode estar correta, mas a autorização (você tem direito a isto?) falha, abrindo brechas para escalação de privilégios ou acesso a dados sensíveis.

Ejemplo

Uma API verifica se o usuário está logado antes de retornar dados de perfil, mas não valida se ele é dono do perfil consultado. Um atacante consegue acessar dados de outros usuários apenas mudando um ID na requisição. Ou um sistema de permissões usa condições OR quando deveria usar AND, liberando acesso para mais atores que o pretendido.

Cómo mitigar

Implemente controle de acesso a cada operação sensível verificando explicitamente se o usuário autenticado tem permissão específica para aquele recurso (não assuma contexto). Use bibliotecas de autorização consolidadas, testes unitários que validem negação de acesso, e revise a lógica de permissões regularmente, especialmente em APIs e operações administrativas.

CVE-2023-41994MEDIUMA logic issue was addressed with improved checks This issue is fixed in macOS Sonoma 14. A camera extension may be able to access the cameraEPSS 0.2%CVE-2025-15342MEDIUMTanium addressed an improper access controls vulnerability in Reputation.EPSS 0.2%CVE-2026-102297MEDIUMZoneMinder before 1.38.4 Incorrect Authorization in frames API indexEPSS 0.2%CVE-2026-87452LOWIncorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer EPSS 0.2%CVE-2024-3745HIGHMSI Afterburner v4.6.6.16381 Beta 3 - ACL BypassEPSS 0.2%CVE-2023-23538MEDIUMA logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An app may be able to moEPSS 0.2%CVE-2024-39871MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do not properly separatEPSS 0.2%CVE-2026-92130LOWJenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolEPSS 0.2%CVE-2024-4465MEDIUMIncorrect authorization for Reports configuration in Guardian/CMC before 24.2.0EPSS 0.2%CVE-2023-35983—This issue was addressed with improved data protection. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7EPSS 0.2%CVE-2025-24121LOWA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An aEPSS 0.2%CVE-2026-18236CRITICALGoogle-ADK Continuation ForgeryEPSS 0.2%CVE-2025-24114MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS VenturEPSS 0.2%CVE-2025-10696HIGHOpenSupports 4.11.0 — Insecure Direct Object Reference in supervised listEPSS 0.2%CVE-2025-30162LOWEast-west traffic not subject to egress policy enforcement for requests via Gateway API load balancersEPSS 0.2%CVE-2025-20381MEDIUMSPL commands allowlist controls bypass in Splunk MCP Server app through "run_splunk_query" MCP toolEPSS 0.2%CVE-2025-67740LOWIn JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadataEPSS 0.2%CVE-2026-78898MEDIUMIncorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypaEPSS 0.2%CVE-2026-82875MEDIUMToolJet before v3.16.208 Authorization Bypass via organizationIdEPSS 0.2%CVE-2026-87575MEDIUMIncorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass EPSS 0.2%