Falhas do tipo CWE-863

3.888 resultados

Falha em verificação de autorização

O software realiza uma verificação de autorização, mas a implementação está incorreta ou incompleta, permitindo que um atacante contorne as restrições de acesso pretendidas. O erro típico é lógica falha na verificação (condições mal formuladas, casos não tratados) ou confiança em dados do usuário para validar permissões.

Exemplo

Uma aplicação web valida se o usuário está autenticado, mas esquece de checar se ele tem permissão para acessar o recurso específico. Um atacante muda o ID do objeto na URL e acessa dados de outro usuário porque a aplicação não verifica propriedade ou role antes de retornar o conteúdo.

Como mitigar

Implemente verificações de autorização explícitas em todo ponto de acesso a recurso sensível, verificando não apenas quem é o usuário, mas se ele tem permissão específica para aquela ação. Use um modelo de controle de acesso bem definido (RBAC, ABAC) e teste sistematicamente casos de bypass (usuários não autorizados, escalação de privilégio, alteração de parâmetros).

CVE-2026-25660CRITICALAuthentication bypass for certain API callsEPSS 0.4%CVE-2024-21278HIGHVulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award Processes).EPSS 0.4%CVE-2024-21279HIGHVulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.EPSS 0.4%CVE-2025-8533MEDIUMIncorrect Authorization of XPC Service in Fantastical.appEPSS 0.4%CVE-2024-21282HIGHVulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components). Supported versions that are affecEPSS 0.4%CVE-2024-57678MEDIUMAn access control issue in the component form2WlAc.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set theEPSS 0.4%CVE-2024-44136CRITICALThis issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical accesEPSS 0.4%CVE-2026-118516MEDIUMSymfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access ControlEPSS 0.4%CVE-2026-23902HIGHApache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.EPSS 0.4%CVE-2025-36546CRITICALF5OS Appliance Mode vulnerabilityEPSS 0.4%CVE-2024-57676MEDIUMAn access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers EPSS 0.4%CVE-2025-0937HIGHNomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard NamespaceEPSS 0.4%CVE-2024-21269HIGHVulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: Compensation Plan). Supported versions thEPSS 0.4%CVE-2024-21283HIGHVulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). SuppoEPSS 0.4%CVE-2024-55965MEDIUMAn issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a worksEPSS 0.4%CVE-2024-21265HIGHVulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Site Hierarchy Flows). Supported versions that are affeEPSS 0.4%CVE-2024-21271HIGHVulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Field Service Engineer Portal). Supported versionsEPSS 0.4%CVE-2024-21270HIGHVulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Tasks). Supported versions that areEPSS 0.4%CVE-2025-21568MEDIUMVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). The supportEPSS 0.4%CVE-2026-96680MEDIUMByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorizationEPSS 0.4%