Falhas do tipo CWE-285

1.609 resultados

Falha na verificação de autorização

A aplicação não valida (ou valida incorretamente) se um usuário tem permissão para acessar um recurso ou executar uma ação. Um atacante contorna controles de acesso acessando dados, executando operações ou alterando funcionalidades que deveria estar restrito à sua role ou nível de privilégio.

Exemplo

Uma API de admin que exclui usuários verifica se o token é válido, mas nunca confirma se quem faz a requisição é realmente administrador. Um usuário comum envia a mesma requisição e consegue deletar contas — porque a autorização não foi checada.

Como mitigar

Implemente verificações de autorização em todo ponto de acesso sensível: valide permissões não só na camada de apresentação, mas no backend, consulte ACLs/roles antes de cada operação crítica e use frameworks de autorização testados. Nunca confie em verificações do lado do cliente.

CVE-2026-11619MEDIUMDolibarr ERP CRM Legacy Filemanager config.inc.php improper authorizationEPSS 0.2%CVE-2025-46732MEDIUMOpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other usersEPSS 0.2%CVE-2026-83431MEDIUMVulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected aEPSS 0.2%CVE-2018-9867—In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in EPSS 0.2%CVE-2025-22176MEDIUMJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of senEPSS 0.2%CVE-2025-22168MEDIUMJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of senEPSS 0.2%CVE-2025-22170MEDIUMJira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they inEPSS 0.2%CVE-2025-22173MEDIUMJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of senEPSS 0.2%CVE-2025-22172MEDIUMJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of senEPSS 0.2%CVE-2025-22174MEDIUMJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of senEPSS 0.2%CVE-2025-22177MEDIUMJira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of senEPSS 0.2%CVE-2022-33705—Information exposure in Calendar prior to version 12.3.05.10000 allows attacker to access calendar schedule without READ_CALENDAR permissionEPSS 0.2%CVE-2022-30717MEDIUMImproper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink.EPSS 0.2%CVE-2026-14538MEDIUMBigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP ToolboxEPSS 0.2%CVE-2025-46289MEDIUMA logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2.EPSS 0.2%CVE-2026-12213MEDIUMhcengineering Huly Platform User Information operations.ts getAccountInfo improper authorizationEPSS 0.2%CVE-2022-36838MEDIUMImplicit Intent hijacking vulnerability in Galaxy Wearable prior to version 2.2.50 allows attacker to get sensitive information.EPSS 0.2%CVE-2026-18985HIGHEdit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093EPSS 0.2%CVE-2021-36311MEDIUMDell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. Any local malicious user with networker user privEPSS 0.2%CVE-2026-10211MEDIUMAstrBotDevs AstrBot fs.py _normalize_rw_path authorizationEPSS 0.2%