Falhas do tipo CWE-862

10.142 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2023-30490HIGHWordPress Easing Slider plugin <= 3.0.8 - Plugin Settings Reset VulnerabilityEPSS 0.8%CVE-2021-32503—Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious aEPSS 0.8%CVE-2023-0805MEDIUMAn issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 1EPSS 0.8%CVE-2024-11423HIGHUltimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money GlitchEPSS 0.8%CVE-2021-40502—SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resultEPSS 0.8%CVE-2021-44233—SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated userEPSS 0.8%CVE-2024-2216HIGHA missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permiEPSS 0.8%CVE-2026-82923CRITICALAI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST RoutesEPSS 0.8%CVE-2024-1982MEDIUMWPvivid Backup and Migration <= 0.9.68 - Missing AuthorizationEPSS 0.8%CVE-2020-36716HIGHWP Activity Log <= 4.0.1 - Missing AuthorizationEPSS 0.8%CVE-2022-45410MEDIUMWhen a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownEPSS 0.8%CVE-2022-38651CRITICALA security filter misconfiguration exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to byEPSS 0.8%CVE-2022-41937CRITICALMissing Authorization in XWiki PlatformEPSS 0.8%CVE-2022-36024HIGHBots using py-cord as discord api wrapper are vulnerable to shutdowns through remote code executionEPSS 0.8%CVE-2024-10800HIGHWordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 0.8%CVE-2024-12955MEDIUMPHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgeryEPSS 0.8%CVE-2023-43652HIGHNon-MFA account takeover via using only SSH public key to login in jumpserverEPSS 0.8%CVE-2019-25139MEDIUMComing Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings ResetEPSS 0.8%CVE-2022-0745—Like Button Rating < 2.6.45 - Arbitrary e-mail SendingEPSS 0.8%CVE-2022-41254MEDIUMMissing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to connect to an attackerEPSS 0.8%