Falhas do tipo CWE-862

9.259 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2026-100854MEDIUMAzuraCast before 0.23.6 Metadata Injection via Liquidsoap APIEPSS 0.2%CVE-2026-106369MEDIUMMissing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer procesEPSS 0.2%CVE-2026-96551MEDIUMsfturing hosp_order CommonUserController.java cross-site request forgeryEPSS 0.2%CVE-2026-106095LOWCode Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippetEPSS 0.2%CVE-2026-102397MEDIUMWordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-97075MEDIUMWordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2022-20556LOWIn launchConfigNewNetworkFragment of NetworkProviderSettings.java, there is a possible way for the guest user to add a new WiFi network due EPSS 0.2%CVE-2023-48683HIGHSensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect CEPSS 0.2%CVE-2026-105706MEDIUMSourceCodester Drug Recommendation System cross-site request forgeryEPSS 0.2%CVE-2026-107623MEDIUMKeycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocationEPSS 0.2%CVE-2026-90454MEDIUMMissing authorization in MalcolmEPSS 0.2%CVE-2026-90508MEDIUMChengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorizationEPSS 0.2%CVE-2022-39092HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2026-15550MEDIUMNinja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init HookEPSS 0.2%CVE-2025-43000HIGHInformation Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW)EPSS 0.2%CVE-2022-39091HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2026-82964HIGHAvast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sysEPSS 0.2%CVE-2022-39090HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2026-16190LOWIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesEPSS 0.2%CVE-2022-20519LOWIn onCreate of AddAppNetworksActivity.java, there is a possible way for a guest user to configure WiFi networks due to a missing permission EPSS 0.2%