Weaknesses of type CWE-862

8,593 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-56341HIGHAVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.phpEPSS 0.5%CVE-2025-52024CRITICALA vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthentEPSS 0.5%CVE-2024-2292HIGHAccess Control Vulnerabilities lead to Violation of Privacy and Modification of Personal DataEPSS 0.5%CVE-2026-9284HIGHWooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information DisclosureEPSS 0.5%CVE-2026-86993MEDIUMn8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership CheckEPSS 0.5%CVE-2023-36676MEDIUMWordPress Spectra plugin <= 2.6.6 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-43962MEDIUMWordPress LWS Affiliation plugin <= 2.3.4 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-45330MEDIUMDecidim: Verification admins can access supplied IDs from other organisationsEPSS 0.5%CVE-2023-2562MEDIUMGallery Metabox <= 1.5 - Missing Authorization via refresh_metaboxEPSS 0.5%CVE-2025-64407MEDIUMApache OpenOffice: URL fetching can be used to exfiltrate arbitrary INI file values and environment variablesEPSS 0.5%CVE-2023-25799HIGHWordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilitiesEPSS 0.5%CVE-2024-54252MEDIUMWordPress Pinpoint Booking System Plugin <= 2.9.9.5.7 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-4730MEDIUMLadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.3 - Missing Authorization via init_endpointEPSS 0.5%CVE-2026-47718MEDIUMFUXA provides guest and invalid-token access to protected read APIs in secure modeEPSS 0.5%CVE-2026-70475HIGHFlowise: Missing Authorization on Execution Update EndpointEPSS 0.5%CVE-2023-48332MEDIUMWordPress Mail Bank – #1 Mail SMTP Plugin for WordPress plugin <= 4.0.14 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-52416CRITICALWordPress Debug Tool plugin <= 2.2 - Remote Code Execution vulnerabilityEPSS 0.5%CVE-2026-85400HIGHTYPO3 CMS - Missing Authorization in lowlevel commandsEPSS 0.5%CVE-2025-11581MEDIUMPowerJob OpenAPIController runJob authorizationEPSS 0.5%CVE-2026-70483LOWOpen WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpointEPSS 0.5%