Falhas do tipo CWE-862

9.264 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2026-109696MEDIUMWordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-6509HIGHPrivilege Escalation in TUBITAK BILGEM's Pardus UpdateEPSS 0.1%CVE-2026-100593MEDIUMOpenClaw before 2026.7.1 Authentication Bypass via activationEPSS 0.1%CVE-2026-84569MEDIUMAn access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Golden Gate 27. AEPSS 0.1%CVE-2023-21133MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2023-20926MEDIUMIn onParentVisible of HeaderPrivacyIconsController.kt, there is a possible way to bypass factory reset protections due to a missing permissiEPSS 0.1%CVE-2026-16965MEDIUMSolace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_statusEPSS 0.1%CVE-2026-91009MEDIUMActive Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachmentEPSS 0.1%CVE-2026-13414MEDIUMCMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajaxEPSS 0.1%CVE-2023-21140MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2026-15246MEDIUMRealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment BypassEPSS 0.1%CVE-2026-9771HIGHMissing device-pointer validation in flash_copy() syscall allows userspace privilege escalationEPSS 0.1%CVE-2023-21132MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2023-21134MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2022-38678MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional EPSS 0.1%CVE-2022-38684MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional EPSS 0.1%CVE-2022-38682MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional EPSS 0.1%CVE-2022-38683MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional EPSS 0.1%CVE-2022-39104MEDIUMIn contacts service, there is a missing permission check. This could lead to local denial of service in Contacts service with no additional EPSS 0.1%CVE-2026-84551MEDIUMA logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOEPSS 0.1%