Weaknesses of type CWE-862

8,594 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-4730MEDIUMLadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.3 - Missing Authorization via init_endpointEPSS 0.5%CVE-2026-47718MEDIUMFUXA provides guest and invalid-token access to protected read APIs in secure modeEPSS 0.5%CVE-2026-77767HIGHReconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without AuthenticationEPSS 0.5%CVE-2026-84990HIGHntopng: Missing Authorization on System Configuration Backup Download and ListingEPSS 0.5%CVE-2026-34184HIGHMissing Authorization inAlanWeb SCADAEPSS 0.5%CVE-2024-6180HIGHEventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings UpdatesEPSS 0.5%CVE-2024-1688MEDIUMWoo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report RetrievalEPSS 0.5%CVE-2026-61442HIGHPraisonAI Platform before 0.1.9 Authorization Bypass via PATCHEPSS 0.5%CVE-2024-5541MEDIUMIbtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings UpdateEPSS 0.5%CVE-2023-39998HIGHWordPress BeTheme theme <= 27.1.1 - Author+ Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-37111HIGHWordPress WishList Member X plugin < 3.26.7 - Unauthenticated Denial of Service Attack vulnerabilityEPSS 0.5%CVE-2024-32776MEDIUMWordPress AppPresser plugin <= 4.3.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-66027HIGHSuna < 0.9.102 Broken Access Control via Message Queue APIEPSS 0.5%CVE-2023-45275MEDIUMWordPress Contact Form builder with drag & drop plugin <= 2.3.28 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-94496HIGHjshERP through 3.6 Privilege Escalation via Role ManagementEPSS 0.5%CVE-2025-23527MEDIUMWordPress WC Wallet plugin <= 2.2.0 - Arbitrary Content Deletion vulnerabilityEPSS 0.5%CVE-2026-43580MEDIUMOpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser InteractionsEPSS 0.5%CVE-2025-23764MEDIUMWordPress Copy Move Posts plugin <= 1.6 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-4683MEDIUMSmartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings UpdateEPSS 0.5%CVE-2025-1309HIGHUiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.04 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.5%