Weaknesses of type CWE-862

8,596 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-39305MEDIUMWordPress Yet Another Stars Rating plugin <= 3.4.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-37232HIGHWordPress Hercules Core plugin <= 6.5 - Subscriber+ Arbitrary Settings Change/Access vulnerabilityEPSS 0.4%CVE-2026-18422LOWConcrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token ValidationEPSS 0.4%CVE-2023-24375LOWWordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-12190MEDIUMContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission DisclosureEPSS 0.4%CVE-2026-94001MEDIUMKeycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permissionEPSS 0.4%CVE-2023-40608HIGHWordPress Paid Memberships Pro CCBill Gateway plugin <= 0.3 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-70986HIGHIncorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive departmentEPSS 0.4%CVE-2024-12876CRITICALGolo - Directory & Listing, Travel WordPress Theme <= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password ChangeEPSS 0.4%CVE-2026-48169HIGHPraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform APIEPSS 0.4%CVE-2026-84801HIGHCraft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsersEPSS 0.4%CVE-2026-62233HIGHgrav-plugin-api < 1.0.6 Privilege Escalation via createApiKeyEPSS 0.4%CVE-2024-39640MEDIUMWordPress Social Feed Gallery plugin <= 4.3.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-4261HIGHExpire Users <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fieldsEPSS 0.4%CVE-2026-5200HIGHAcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'EPSS 0.4%CVE-2023-26520MEDIUMWordPress Advanced Text Widget plugin <= 2.1.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-31297HIGHWordPress Wholesale For WooCommerce plugin <= 2.3.1 - Unauthenticated Arbitrary Post/Page vulnerabilityEPSS 0.4%CVE-2026-58243HIGHPrivilege Escalation vulnerability in SAP ABAP Developer ToolsEPSS 0.4%CVE-2024-43274MEDIUMWordPress JS Help Desk – The Ultimate Help Desk plugin <= 2.8.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-5117HIGHProperty 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal RegistrationEPSS 0.4%