Falhas do tipo CWE-862

9.258 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2022-20503HIGHIn onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration due to a missing permiEPSS 0.2%CVE-2026-87860MEDIUMSubscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRFEPSS 0.2%CVE-2026-106344MEDIUMMissing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer procEPSS 0.2%CVE-2026-97176MEDIUMKeycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticatorEPSS 0.2%CVE-2022-20506HIGHIn onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of privilege from a guest uEPSS 0.2%CVE-2023-44214MEDIUMSensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) beEPSS 0.2%CVE-2022-38670HIGHIn soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additioEPSS 0.2%CVE-2023-45242MEDIUMSensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (LinuxEPSS 0.2%CVE-2023-45240MEDIUMSensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) beEPSS 0.2%CVE-2025-15473MEDIUMTimetics < 1.0.52 - Unauthenticated Payment/Booking Status UpdateEPSS 0.2%CVE-2022-38669HIGHIn soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additioEPSS 0.2%CVE-2022-2985HIGHIn music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execEPSS 0.2%CVE-2026-94260MEDIUMSifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order FailureEPSS 0.2%CVE-2026-105975MEDIUMCamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_referenceEPSS 0.2%CVE-2026-104751MEDIUMRank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results DeletionEPSS 0.2%CVE-2026-94360MEDIUMPaymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card CallbacksEPSS 0.2%CVE-2026-66061HIGHHome Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation executionEPSS 0.2%CVE-2026-66060HIGHHome Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callersEPSS 0.2%CVE-2026-86850MEDIUMSKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation DeletionEPSS 0.2%CVE-2026-55530MEDIUMPraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation toolEPSS 0.2%