Weaknesses of type CWE-862

8,596 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-25517MEDIUMWagtail has improper permission handling on admin preview endpointsEPSS 0.4%CVE-2026-43573MEDIUMOpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction RoutesEPSS 0.4%CVE-2024-56295MEDIUMWordPress Poll Maker plugin <= 5.5.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-3233MEDIUMIvory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index CreationEPSS 0.4%CVE-2026-76876HIGHCraftplan < 0.5.1 Broken Access Control Information Disclosure via Settings APIEPSS 0.4%CVE-2024-11069MEDIUMWordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User DeletionEPSS 0.4%CVE-2024-3520MEDIUMCountry State City Dropdown CF7 <= 2.7.1 - Missing AuthorizationEPSS 0.4%CVE-2023-48760HIGHWordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-43577HIGHOpenClaw < 2026.4.9 - Arbitrary File Read via Browser Interaction RoutesEPSS 0.4%CVE-2025-1402MEDIUMEvent Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket DeletionEPSS 0.4%CVE-2026-26367HIGHJUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccountEPSS 0.4%CVE-2026-86085MEDIUMn8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment EndpointsEPSS 0.4%CVE-2024-43247HIGHWordPress WHMpress plugin <= 6.2-revision-5 - Subscriber+ Arbitrary Settings Change vulnerabilityEPSS 0.4%CVE-2025-32254MEDIUMWordPress WPBookit plugin <= 1.0.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-47188MEDIUMWordPress Simple Job Board plugin <= 2.10.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-33992MEDIUMMissing Authorization Check in SAP Business Warehouse and SAP BW/4HANAEPSS 0.4%CVE-2024-1733MEDIUMWord Replacer Pro <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content UpdateEPSS 0.4%CVE-2023-46148HIGHWordPress Themify Ultra theme <= 7.3.5 - Authenticated Arbitrary Settings Change vulnerabilityEPSS 0.4%CVE-2026-4019MEDIUMComplianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST EndpointEPSS 0.4%CVE-2026-18422LOWConcrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token ValidationEPSS 0.4%