Weaknesses of type CWE-862

8,596 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-58243HIGHPrivilege Escalation vulnerability in SAP ABAP Developer ToolsEPSS 0.4%CVE-2024-43274MEDIUMWordPress JS Help Desk – The Ultimate Help Desk plugin <= 2.8.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2023-29173MEDIUMWordPress Product Category Tree plugin <= 2.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-47361MEDIUMWordPress Elementor Addon Elements plugin <= 1.13.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-4261HIGHExpire Users <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fieldsEPSS 0.4%CVE-2026-56396HIGHphpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()EPSS 0.4%CVE-2026-9013MEDIUMBogo <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST APIEPSS 0.4%CVE-2026-2941HIGHLinksy Search and Replace <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy_search_and_replace_item_detailsEPSS 0.4%CVE-2024-39640MEDIUMWordPress Social Feed Gallery plugin <= 4.3.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-76057MEDIUMAutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX ActionEPSS 0.4%CVE-2025-5117HIGHProperty 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal RegistrationEPSS 0.4%CVE-2023-5711MEDIUMSystem Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)EPSS 0.4%CVE-2023-36515HIGHWordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-81909MEDIUMConcrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocksEPSS 0.4%CVE-2026-50026MEDIUMFrappe: Lack of permissions checks in 'relink' and 'set_email_password' endpointsEPSS 0.4%CVE-2024-38721HIGHWordPress EazyDocs plugin <= 2.5.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-3216MEDIUMWooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings ResetEPSS 0.4%CVE-2024-54298MEDIUMWordPress Car Dealer plugin <= 4.46 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-1126MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List RetrievalEPSS 0.4%