Falhas do tipo CWE-863

3.061 resultados

Falha em verificação de autorização

O software realiza uma verificação de autorização, mas a implementação está incorreta ou incompleta, permitindo que um atacante contorne as restrições de acesso pretendidas. O erro típico é lógica falha na verificação (condições mal formuladas, casos não tratados) ou confiança em dados do usuário para validar permissões.

Exemplo

Uma aplicação web valida se o usuário está autenticado, mas esquece de checar se ele tem permissão para acessar o recurso específico. Um atacante muda o ID do objeto na URL e acessa dados de outro usuário porque a aplicação não verifica propriedade ou role antes de retornar o conteúdo.

Como mitigar

Implemente verificações de autorização explícitas em todo ponto de acesso a recurso sensível, verificando não apenas quem é o usuário, mas se ele tem permissão específica para aquela ação. Use um modelo de controle de acesso bem definido (RBAC, ABAC) e teste sistematicamente casos de bypass (usuários não autorizados, escalação de privilégio, alteração de parâmetros).

CVE-2026-87508MEDIUMIncorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafteEPSS 0.3%CVE-2026-79190MEDIUMIncorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proEPSS 0.3%CVE-2026-16140HIGHOpenBMC IPMI Privilege Escalation via Retargeted RAKP 1EPSS 0.3%CVE-2025-21539MEDIUMVulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). The supported version EPSS 0.3%CVE-2026-28724MEDIUMUnauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 (LinuxEPSS 0.3%CVE-2026-79262MEDIUMIncorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftEPSS 0.3%CVE-2026-89032HIGHBerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache LayerEPSS 0.3%CVE-2025-68940LOWIn Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.EPSS 0.3%CVE-2026-87466MEDIUMIncorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a craftEPSS 0.3%CVE-2026-79082MEDIUMIncorrect authorization in Transactions Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the rEPSS 0.3%CVE-2026-79093MEDIUMIncorrect authorization in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy vEPSS 0.3%CVE-2026-79174MEDIUMIncorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proEPSS 0.3%CVE-2026-86755MEDIUMSnipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuthEPSS 0.3%CVE-2026-62198MEDIUMOpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web SearchEPSS 0.3%CVE-2025-62275MEDIUMBlogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 thrEPSS 0.3%CVE-2026-50550MEDIUMSnipe-IT: 2FA reset privilege bypassEPSS 0.3%CVE-2026-33884MEDIUMStatamic's live preview token bypasses content protection for unrelated entriesEPSS 0.3%CVE-2024-54495MEDIUMThe issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able EPSS 0.3%CVE-2026-6343MEDIUMMattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooksEPSS 0.3%CVE-2025-6981MEDIUMIncorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only accessEPSS 0.3%