Falhas do tipo CWE-862

7.123 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2025-4095MEDIUMRegistry Access Management (RAM) policies not applied when sign-in enforcement is configured via a configuration profileEPSS 0.1%CVE-2026-28573CRITICALIn AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial EPSS 0.1%CVE-2025-8887MEDIUMIDOR in Usta Information Systems' Aybs InteraktifEPSS 0.1%CVE-2026-32442MEDIUMWordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2022-39117HIGHIn messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2024-0038HIGHIn injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing pEPSS 0.1%CVE-2026-58482MEDIUMNetwork-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actionsEPSS 0.1%CVE-2026-32562MEDIUMWordPress PPWP plugin <= 1.9.15 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2024-42035HIGHPermission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality EPSS 0.1%CVE-2023-21244MEDIUMIn visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead EPSS 0.1%CVE-2023-52713HIGHVulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affEPSS 0.1%CVE-2023-20916HIGHIn getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from tEPSS 0.1%CVE-2026-11858HIGHMissing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEMEPSS 0.1%CVE-2023-21140MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2023-21132MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2023-20912HIGHIn onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permissEPSS 0.1%CVE-2023-21133MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2023-21134MEDIUMIn onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission checkEPSS 0.1%CVE-2026-20626HIGHThis issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Tahoe 26.3, visiEPSS 0.1%CVE-2025-0086MEDIUMIn onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could leaEPSS 0.1%