Falhas do tipo CWE-862

9.268 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2026-87552MEDIUMMissing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensiEPSS 0.1%CVE-2022-39115MEDIUMIn Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional executEPSS 0.1%CVE-2026-80432MEDIUMMissing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a dropEPSS 0.1%CVE-2026-18425LOWIDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pagesEPSS 0.1%CVE-2026-15916MEDIUMDrupal core - Moderately critical - Information disclosure - SA-CORE-2026-010EPSS 0.1%CVE-2026-47559HIGHNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belonginEPSS 0.1%CVE-2026-33802MEDIUMJunos OS: EX Series: Unauthorized users can execute service-impacting CLI commandEPSS 0.1%CVE-2025-41698HIGHDraeger: ICMHelper is vulnerable to a privilege escalation due too missing authorizationEPSS 0.1%CVE-2022-20508HIGHIn onAttach of ConfigureWifiSettings.java, there is a possible way for a guest user to change WiFi settings due to a permissions bypass. ThiEPSS 0.1%CVE-2025-13348HIGHAn improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can be triggered bEPSS 0.1%CVE-2022-20547HIGHIn multiple functions of AdapterService.java, there is a possible way to manipulate Bluetooth state due to a missing permission check. This EPSS 0.1%CVE-2022-20510MEDIUMIn getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the notification streaminEPSS 0.1%CVE-2021-39810HIGHIn verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app withEPSS 0.1%CVE-2026-20696MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOSEPSS 0.1%CVE-2026-108064MEDIUMWP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handlerEPSS 0.1%CVE-2022-44423MEDIUMIn music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional exeEPSS 0.1%CVE-2025-48549HIGHIn multiple locations, there is a possible way to record audio via a background app due to a missing permission check. This could lead to loEPSS 0.1%CVE-2022-44435—In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44439MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44437MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%