Weaknesses of type CWE-862

8,595 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-25876MEDIUMPlaciPy is Missing Authorization on Assessment Results EndpointEPSS 0.5%CVE-2026-25810MEDIUMPlaciPy is Missing Object-Level Authorization in student.submission.routes.tsEPSS 0.5%CVE-2026-15411MEDIUMStoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX ActionEPSS 0.5%CVE-2025-57955MEDIUMWordPress Post Carousel Slider for Elementor Plugin <= 1.7.0 - Broken Access Control VulnerabilityEPSS 0.5%CVE-2025-57909MEDIUMWordPress Editor Custom Color Palette plugin <= 3.5.6 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-2110HIGHWP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple FunctionsEPSS 0.5%CVE-2026-56115HIGHBootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization BypassEPSS 0.5%CVE-2024-54217MEDIUMWordPress ARForms plugin <= 6.4.1 - Subscriber+ Plugin Settings Change vulnerabilityEPSS 0.5%CVE-2025-27270CRITICALWordPress Residential Address Detection Plugin <= 2.5.4 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-55545MEDIUMYamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforceEPSS 0.5%CVE-2026-7563MEDIUMClassified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX ActionsEPSS 0.5%CVE-2024-37463MEDIUMWordPress CRM Perks Forms plugin <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-45632CRITICALDokploy: Schedule Authorization Bypass Enables Host/Server Command ExecutionEPSS 0.5%CVE-2026-62218HIGHOpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approveEPSS 0.5%CVE-2026-56250HIGHCapgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versionsEPSS 0.5%CVE-2026-85058HIGHMoquette: Missing Authorization in io.moquette:moquette-brokerEPSS 0.5%CVE-2024-32712HIGHWordPress Podlove Podcast Publisher plugin <= 4.0.14 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-78361CRITICALzipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option DeletionEPSS 0.5%CVE-2026-70473HIGHFlowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyEPSS 0.5%CVE-2024-5129HIGHPrivilege Escalation Vulnerability in lunary-ai/lunaryEPSS 0.4%