Weaknesses of type CWE-862

8,465 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2021-24831—Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX CallsEPSS 1.2%CVE-2021-25093—Link Library < 7.2.8 - Unauthenticated Arbitrary Links DeletionEPSS 1.2%CVE-2026-12646CRITICALA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cEPSS 1.2%CVE-2024-12155CRITICALSV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options UpdateEPSS 1.2%CVE-2026-12647CRITICALA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cEPSS 1.2%CVE-2021-44793HIGHInformation Leakege via Unauthorized Access in Single ConnectEPSS 1.2%CVE-2024-4352HIGHTutor LMS Pro <= 2.7.0 - Missing Authorization to SQL InjectionEPSS 1.2%CVE-2021-22513—Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6EPSS 1.2%CVE-2024-10673HIGHTop Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/ActivationEPSS 1.2%CVE-2021-24352—Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect ExportEPSS 1.2%CVE-2020-26212HIGHAny GLPI CalDAV calendars is read-only for every authenticated userEPSS 1.2%CVE-2026-42569CRITICALphpvms: /importer authorization bypass causing full database wipeEPSS 1.2%CVE-2018-14628—An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivilEPSS 1.2%CVE-2024-8349HIGHUncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege EscalationEPSS 1.2%CVE-2022-0919—Salon booking system < 7.6.3 - Unauthenticated Sensitive Data DisclosureEPSS 1.2%CVE-2021-31384HIGHJunos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the serviceEPSS 1.2%CVE-2021-3814—It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This concEPSS 1.2%CVE-2026-28515CRITICALopenDCIM <= 23.04 Missing Authorization in install.phpEPSS 1.2%CVE-2024-0683HIGHBulgarisation for WooCommerce <= 3.0.14 - Missing AuthorizationEPSS 1.2%CVE-2026-27796MEDIUMHomarr: Unauthenticated Information Disclosure (Integration Metadata Leak)EPSS 1.2%