Falhas do tipo CWE-285

1.605 resultados

Falha na verificação de autorização

A aplicação não valida (ou valida incorretamente) se um usuário tem permissão para acessar um recurso ou executar uma ação. Um atacante contorna controles de acesso acessando dados, executando operações ou alterando funcionalidades que deveria estar restrito à sua role ou nível de privilégio.

Exemplo

Uma API de admin que exclui usuários verifica se o token é válido, mas nunca confirma se quem faz a requisição é realmente administrador. Um usuário comum envia a mesma requisição e consegue deletar contas — porque a autorização não foi checada.

Como mitigar

Implemente verificações de autorização em todo ponto de acesso sensível: valide permissões não só na camada de apresentação, mas no backend, consulte ACLs/roles antes de cada operação crítica e use frameworks de autorização testados. Nunca confie em verificações do lado do cliente.

CVE-2024-42036LOWAccess permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service EPSS 0.1%CVE-2023-28973HIGHJunos OS Evolved: The 'sysmanctl' shell command allows a local user to gain access to some administrative actions EPSS 0.1%CVE-2026-3671MEDIUMFreedom Factory dGEN1 org.ethereumphone.walletmanager.testing123 TokenBalanceContentProvider improper authorizationEPSS 0.1%CVE-2026-84621MEDIUMAn authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, maEPSS 0.1%CVE-2026-84615MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, EPSS 0.1%CVE-2026-17433MEDIUMnanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorizationEPSS 0.1%CVE-2023-21461MEDIUMImproper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows local attacker to turEPSS 0.1%CVE-2026-3674MEDIUMFreedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppProvider improper authorizationEPSS 0.1%CVE-2026-3669MEDIUMFreedom Factory dGEN1 com.dgen.alarm AlarmService improper authorizationEPSS 0.1%CVE-2026-3670MEDIUMFreedom Factory dGEN1 com.dgen.alarm improper authorizationEPSS 0.1%CVE-2026-3667MEDIUMFreedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppService improper authorizationEPSS 0.1%CVE-2026-3675MEDIUMFreedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppReceiver improper authorizationEPSS 0.1%CVE-2022-36857LOWImproper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows physical attackers to read internal application EPSS 0.1%CVE-2026-28845MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.4. An app may be able to access pEPSS 0.1%CVE-2022-45874MEDIUMHuawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain filEPSS 0.1%CVE-2023-41819MEDIUM A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local attacker to access unEPSS 0.1%CVE-2026-84556MEDIUMAn authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS TaEPSS 0.1%CVE-2026-65353MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6. An aEPSS 0.1%CVE-2026-84636MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watcEPSS 0.1%CVE-2026-43695MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOEPSS 0.1%