Falhas do tipo CWE-862

8.451 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2020-36719CRITICALListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and DeactivationEPSS 4.3%CVE-2022-0236HIGHWP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data DisclosureEPSS 4.3%CVE-2024-43045MEDIUMJenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/EPSS 4.3%CVE-2022-1054—RSVP and Event Management < 2.7.8 - Unauthenticated Entries ExportEPSS 4.2%CVE-2024-4898CRITICALInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User CreationEPSS 4.2%CVE-2026-41266HIGHFlowise: Sensitive Data Leak in public-chatbotConfigEPSS 4.1%CVE-2019-18581CRITICALDell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a servEPSS 3.9%CVE-2025-10184HIGHOnePlus OxygenOS Telephony provider permission bypassEPSS 3.8%CVE-2022-23945—Apache ShenYu missing authentication allows gateway registrationEPSS 3.8%CVE-2023-22478HIGHKubePi is vulnerable to missing authorizationEPSS 3.6%CVE-2017-7548—PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privEPSS 3.5%CVE-2019-10184MEDIUMundertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted throEPSS 3.5%CVE-2024-45591MEDIUMXWiki Platform document history including authors of any page exposed to unauthorized actorsEPSS 3.4%CVE-2022-2379—Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST APIEPSS 3.4%CVE-2025-1562CRITICALRecover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin InstallationEPSS 3.3%CVE-2019-13547—Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use tEPSS 3.3%CVE-2025-45854CRITICAL/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.EPSS 3.2%CVE-2026-73296CRITICALMicrosoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosureEPSS 2.9%CVE-2022-48166HIGHAn access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log fEPSS 2.8%CVE-2021-24997—WP Guppy < 1.3 - Sensitive Information DisclosureEPSS 2.8%