Falhas do tipo CWE-862

8.467 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2018-10865—It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthentiEPSS 1.0%CVE-2026-41315CRITICALmdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')EPSS 1.0%CVE-2025-1639HIGHAnimation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/ActivationEPSS 1.0%CVE-2022-41272CRITICALAn unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NeEPSS 1.0%CVE-2024-13767HIGHLive2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 1.0%CVE-2026-18851HIGHMissing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacEPSS 1.0%CVE-2023-1337MEDIUMRapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_uucss_logs'EPSS 1.0%CVE-2023-22701HIGHWordPress Ebook Store plugin <= 5.775 - Broken Authentication vulnerabilityEPSS 1.0%CVE-2024-6806CRITICALMissing Authorization Checks In NI VeriStand Gateway For Project ResourcesEPSS 1.0%CVE-2022-0932MEDIUMMissing Authorization in saleor/saleorEPSS 1.0%CVE-2025-24181CRITICALA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturEPSS 1.0%CVE-2024-23752CRITICALGenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrarEPSS 1.0%CVE-2021-4357CRITICALuListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page DeletionEPSS 1.0%CVE-2025-50171CRITICALRemote Desktop Spoofing VulnerabilityEPSS 1.0%CVE-2022-25810—Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised CallsEPSS 1.0%CVE-2022-27669—An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to whicEPSS 1.0%CVE-2022-22111HIGHDayByDay CRM - Missing Authorization when Changing PasswordEPSS 1.0%CVE-2021-44794MEDIUMInformation Leakege via Unauthorized Access in Single ConnectEPSS 1.0%CVE-2021-44792MEDIUMInformation Leakege via Unauthorized Access in Single ConnectEPSS 1.0%CVE-2025-31194CRITICALAn authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS EPSS 1.0%