Weaknesses of type CWE-862

8,598 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-11983MEDIUMAd Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajaxEPSS 0.4%CVE-2024-3243MEDIUMCustomer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email SendingEPSS 0.4%CVE-2024-6698HIGHFundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.4%CVE-2024-56061HIGHWordPress RepairBuddy plugin <= 3.8119 - Account Takeover vulnerabilityEPSS 0.4%CVE-2026-6834HIGHaEnrich｜a+HRD - Missing AuthorizationEPSS 0.4%CVE-2024-1050MEDIUMImport and export users and customers <= 1.26.5 - Missing AuthorizationEPSS 0.4%CVE-2024-56211HIGHWordPress UserPro plugin <= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerabilityEPSS 0.4%CVE-2024-32810HIGHWordPress ShortPixel Critical CSS plugin <= 1.0.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-86347HIGHMISP Missing Authorization on Template File Upload Allows Authenticated Disk ExhaustionEPSS 0.4%CVE-2026-92462HIGHyshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStepEPSS 0.4%CVE-2026-92457HIGHyshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoiceEPSS 0.4%CVE-2022-45826MEDIUMWordPress Sunshine Photo Cart plugin <= 2.9.13 - Auth. Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-2945MEDIUMMissing Authorization in openemr/openemrEPSS 0.4%CVE-2026-61718MEDIUMbunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routesEPSS 0.4%CVE-2026-86116HIGHMetabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management APIEPSS 0.4%CVE-2024-33572MEDIUMWordPress Nexter Blocks plugin <= 3.2.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-86114HIGHArcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation EndpointsEPSS 0.4%CVE-2023-25993MEDIUMWordPress Top 10 – Popular posts plugin for WordPress plugin <= 3.2.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-57521MEDIUMBitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceControllerEPSS 0.4%CVE-2025-3952HIGHProjectopia &#8211; WordPress Project Management <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option DeletionEPSS 0.4%