Falhas do tipo CWE-862

9.265 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2026-53820MEDIUMOpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session SpawnEPSS 0.1%CVE-2026-84551MEDIUMA logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOEPSS 0.1%CVE-2026-19755MEDIUMNoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helperEPSS 0.1%CVE-2026-59677MEDIUMProcess Kill Attack Vector in killall() in seunshareEPSS 0.1%CVE-2023-39298HIGHQTS, QuTS heroEPSS 0.1%CVE-2026-8304MEDIUMInformation Disclosure in TUBITAK BILGEM's Pardus AboutEPSS 0.1%CVE-2026-61994MEDIUMWordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-62028MEDIUMWordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-84514MEDIUMThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26EPSS 0.1%CVE-2026-62041MEDIUMWordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-107432MEDIUMWordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-53850MEDIUMOpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus CommandEPSS 0.1%CVE-2026-107430MEDIUMWordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2022-38697MEDIUMIn messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additioEPSS 0.1%CVE-2026-58565HIGHDell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local acceEPSS 0.1%CVE-2026-33785MEDIUMJunos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenarioEPSS 0.1%CVE-2025-68947MEDIUMNSecsoft NSecKrnl process termination privilege escalationEPSS 0.1%CVE-2026-58562HIGHDell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local acceEPSS 0.1%CVE-2024-36326HIGHMissing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, poteEPSS 0.1%CVE-2026-43665MEDIUMThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacEPSS 0.1%