Weaknesses of type CWE-862

8,591 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-4024MEDIUMRoyal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta ModificationEPSS 0.5%CVE-2026-52892MEDIUMWekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)EPSS 0.5%CVE-2026-58176HIGHRuoYi-Vue-Plus - Missing Authorization on Workflow Task Management EndpointsEPSS 0.5%CVE-2026-17153MEDIUMAI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST EndpointEPSS 0.5%CVE-2025-42955LOWMissing authorization check in SAP Cloud ConnectorEPSS 0.5%CVE-2024-37510MEDIUMWordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-16605HIGHMultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing AuthorizationEPSS 0.5%CVE-2026-31834HIGHUmbraco Affected by Vertical Privilege Escalation via Missing Authorization ChecksEPSS 0.5%CVE-2023-23854LOWSAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary auEPSS 0.5%CVE-2026-78328CRITICALA missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privilegedEPSS 0.5%CVE-2023-37885MEDIUMWordPress RealHomes theme <= 4.0.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-3553MEDIUMTutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options UpdateEPSS 0.5%CVE-2024-32688MEDIUMWordPress MyRewards plugin <= 5.3.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-87792HIGHMultiple authorization bypass in WordPress theme design-scuole-wordpress-themeEPSS 0.5%CVE-2024-33589MEDIUMWordPress KB Support plugin <= 1.6.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-2590HIGHMissing Authorization in answerdev/answerEPSS 0.5%CVE-2024-2033MEDIUMVideo Conferencing with Zoom <= 4.4.5 - Sensitive Information ExposureEPSS 0.5%CVE-2026-90939HIGHnovel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list EndpointEPSS 0.5%CVE-2024-35672HIGHWordPress Netgsm plugin <= 2.9.19 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2021-4447HIGHEssential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege EscalationEPSS 0.5%