Weaknesses of type CWE-862

8,601 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-39533HIGHWordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-37425MEDIUMWordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-33685MEDIUMAVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User DataEPSS 0.4%CVE-2026-45415MEDIUMDecidim: CSV census record endpoints improper authorizationEPSS 0.4%CVE-2025-55741HIGHunopim/unopim allows unauthorized product deletion via mass-delete endpointEPSS 0.4%CVE-2024-0836MEDIUMWordPress Review & Structure Data Schema Plugin – Review Schema <= 2.1.14 - Missing Authorization to Arbitrary Review UpdateEPSS 0.4%CVE-2026-16494HIGHMissing Authorization in GitLabEPSS 0.4%CVE-2023-28675MEDIUMA missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously confEPSS 0.4%CVE-2023-3213MEDIUMWP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_pageEPSS 0.4%CVE-2026-19802MEDIUMCheckout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' ParameterEPSS 0.4%CVE-2026-41192HIGHFreeScout's client-controlled attachment IDs allow deletion of existing conversation attachmentsEPSS 0.4%CVE-2023-32127MEDIUMWordPress Multi Rating plugin <= 5.0.6 - Unauth Arbitrary rating value changeEPSS 0.4%CVE-2024-0797MEDIUMActive Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Missing AuthorizationEPSS 0.4%CVE-2026-14349CRITICALTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX ActionEPSS 0.4%CVE-2026-42226HIGHn8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key ReplayEPSS 0.4%CVE-2023-30488MEDIUMWordPress Featured Post Creative plugin <= 1.2.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-1502MEDIUMTutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post DeletionEPSS 0.4%CVE-2023-6959MEDIUMGetwid – Gutenberg Blocks <= 2.0.4 - Missing Authorization to Recaptcha API Key ModificationEPSS 0.4%CVE-2024-4997MEDIUMWPUpper Share Buttons <= 3.43 - Missing AuthorizationEPSS 0.4%CVE-2025-4339MEDIUMTheGem <= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options UpdateEPSS 0.4%