Weaknesses of type CWE-862

8,597 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-57961MEDIUMWordPress CoDesigner plugin <= 4.29 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-3488MEDIUMWP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit ManipulationEPSS 0.4%CVE-2026-77770CRITICALminiOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link ValidatorEPSS 0.4%CVE-2024-38771MEDIUMWordPress Atarim plugin <= 4.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-68920HIGHC-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local syEPSS 0.4%CVE-2024-31368MEDIUMWordPress Soledad theme <= 8.4.2 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-12694CRITICALMissing Authorization in Vimesoft's Enterprise Video PlatformEPSS 0.4%CVE-2023-47764MEDIUMWordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-56008HIGHWordPress Spreadr Woocommerce plugin <= 1.0.4 - Arbitrary Content Deletion vulnerabilityEPSS 0.4%CVE-2026-55106MEDIUMauthentik: Unauthenticated LDAP directory data disclosureEPSS 0.4%CVE-2023-2783MEDIUMApp Framework does not checks for the secret provided in the incoming webhook requestEPSS 0.4%CVE-2026-65050HIGHNinja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated VisitorsEPSS 0.4%CVE-2024-32509MEDIUMWordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.76 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-34820MEDIUMWordPress If-So Dynamic Content Personalization plugin <= 1.7.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-12028MEDIUMFriends <= 3.2.1 - Missing AuthorizationEPSS 0.4%CVE-2026-73249HIGHcalibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation ModificationEPSS 0.4%CVE-2022-3096MEDIUMWP Total Hacks <= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSSEPSS 0.4%CVE-2024-10003MEDIUMRover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple FunctionsEPSS 0.4%CVE-2024-33570MEDIUMWordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-86089LOWApache NiFi: Missing Process Group Authorization for Connector MigrationEPSS 0.4%