Weaknesses of type CWE-862

8,596 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-3216MEDIUMWooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings ResetEPSS 0.4%CVE-2026-50026MEDIUMFrappe: Lack of permissions checks in 'relink' and 'set_email_password' endpointsEPSS 0.4%CVE-2025-68013MEDIUMWordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerabilityEPSS 0.4%CVE-2024-1126MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List RetrievalEPSS 0.4%CVE-2023-5714MEDIUMSystem Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_db_specs)EPSS 0.4%CVE-2026-68529LOWConcrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entriesEPSS 0.4%CVE-2024-33956MEDIUMWordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-33942MEDIUMWordPress Google Typography plugin <= 1.1.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-54298MEDIUMWordPress Car Dealer plugin <= 4.46 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-36515HIGHWordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-47647MEDIUMWordPress BadgeOS plugin <= 3.7.1.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-8712MEDIUMMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22EPSS 0.4%CVE-2024-54267MEDIUMWordPress CM Answers plugin <= 3.2.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-3876HIGHSMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction FunctionEPSS 0.4%CVE-2024-54278MEDIUMWordPress News Ticker for Elementor plugin <= 2.1.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-42989CRITICALMissing Authorization check in SAP NetWeaver Application Server for ABAPEPSS 0.4%CVE-2026-39355CRITICALGenealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)EPSS 0.4%CVE-2024-1763MEDIUMWp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status UpdateEPSS 0.4%CVE-2026-39351MEDIUMFrappe allows unrestricted Doctype access via API exploitEPSS 0.4%CVE-2025-66735HIGHyoulai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permissioEPSS 0.4%