Falhas do tipo CWE-306

3.055 resultados

Falta de autenticação em funcionalidades críticas

O software não valida a identidade do usuário antes de executar operações sensíveis ou que consomem recursos significativos (processamento, armazenamento, banda). Qualquer pessoa, autenticada ou não, consegue acessar e usar essas funcionalidades, criando risco de abuso, consumo não autorizado de recursos ou acesso a dados protegidos.

Exemplo

Uma API de relatórios que permite gerar análises pesadas sem verificar credenciais, permitindo um atacante disparar gerações de relatório em loop para derrubar o servidor. Ou um endpoint de backup que qualquer pessoa consegue chamar sem login, expondo dados sensíveis.

Como mitigar

Implemente verificação obrigatória de identidade (autenticação) em toda funcionalidade sensível ou cara computacionalmente. Use controles de sessão, tokens JWT ou OAuth, e combine com autorização (verificar se o usuário autenticado tem permissão específica para aquela ação).

CVE-2021-43447HIGHONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attEPSS 1.3%CVE-2022-26303HIGHAn external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.0EPSS 1.3%CVE-2022-26043HIGHAn external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform VEPSS 1.3%CVE-2022-27645HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. AuthentiEPSS 1.3%CVE-2022-41331CRITICALA missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a EPSS 1.3%CVE-2019-6820HIGHA CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IPEPSS 1.3%CVE-2026-72577CRITICALNASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command InjectionEPSS 1.3%CVE-2025-48814HIGHRemote Desktop Licensing Service Security Feature Bypass VulnerabilityEPSS 1.3%CVE-2023-47674CRITICALMissing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite oEPSS 1.3%CVE-2026-27604CRITICALFOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin FunctionsEPSS 1.3%CVE-2026-33231HIGHNLTK has unauthenticated remote shutdown in nltk.app.wordnet_appEPSS 1.3%CVE-2026-9317CRITICALNango < 0.71.6 Missing Authentication RCE via runner tRPC serverEPSS 1.3%CVE-2022-32251HIGHA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification foEPSS 1.3%CVE-2023-28326CRITICALApache OpenMeetings: allows user impersonationEPSS 1.3%CVE-2026-23693CRITICALElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST EndpointEPSS 1.3%CVE-2019-13525—In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to EPSS 1.3%CVE-2026-20803HIGHMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2020-12505HIGHWAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07EPSS 1.2%CVE-2025-36535CRITICALAutomationDirect MB-Gateway Missing Authentication for Critical FunctionEPSS 1.2%CVE-2020-10038—A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attackEPSS 1.2%