Weaknesses of type CWE-862

10,119 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2022-0871HIGHMissing Authorization in gogs/gogsEPSS 1.2%CVE-2021-24839—SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket DeletionEPSS 1.2%CVE-2021-4346CRITICALuListing <= 1.6.6 - Unauthenticated Arbitrary Account ChangesEPSS 1.2%CVE-2021-24831—Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX CallsEPSS 1.2%CVE-2026-8848HIGHPopup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin InstallationEPSS 1.2%CVE-2024-2782HIGHContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting ManipulationEPSS 1.2%CVE-2021-22513—Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6EPSS 1.2%CVE-2024-48073CRITICALsunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updaEPSS 1.2%CVE-2026-18851HIGHMissing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacEPSS 1.2%CVE-2018-7689HIGHOpen Build Service arbitrary package modificationEPSS 1.2%CVE-2022-24317—A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. AffecEPSS 1.2%CVE-2018-14628—An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivilEPSS 1.2%CVE-2022-0611MEDIUMMissing Authorization in snipe/snipe-itEPSS 1.2%CVE-2022-23055—ERPNext - Improper user access conrolEPSS 1.2%CVE-2021-25093—Link Library < 7.2.8 - Unauthenticated Arbitrary Links DeletionEPSS 1.2%CVE-2023-47179HIGHWordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerabilityEPSS 1.2%CVE-2024-12155CRITICALSV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options UpdateEPSS 1.2%CVE-2021-44793HIGHInformation Leakege via Unauthorized Access in Single ConnectEPSS 1.2%CVE-2024-4352HIGHTutor LMS Pro <= 2.7.0 - Missing Authorization to SQL InjectionEPSS 1.2%CVE-2020-36698HIGHSecurity & Malware scan by CleanTalk <= 2.50 - Missing AuthorizationEPSS 1.2%