Weaknesses of type CWE-862

8,604 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-16106MEDIUMKeycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child rolesEPSS 0.4%CVE-2024-32777HIGHWordPress BizPrint plugin <= 4.3.39 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-8513MEDIUMQA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings UpdateEPSS 0.4%CVE-2024-43981MEDIUMWordPress GeoDirectory plugin <= 2.3.70 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-16105MEDIUMKeycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpointsEPSS 0.4%CVE-2024-43355MEDIUMWordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-59022HIGHTYPO3 CMS Allows Broken Access Control in Recycler ModuleEPSS 0.4%CVE-2025-14386HIGHSearch Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.12 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account TakeoverEPSS 0.4%CVE-2026-84908MEDIUMWPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX ActionEPSS 0.4%CVE-2026-69190MEDIUMGraylog: Manager-to-Owner privilege escalation on saved searches and dashboardsEPSS 0.4%CVE-2025-24577MEDIUMWordPress Poll Maker plugin <= 5.5.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-4997MEDIUMWPUpper Share Buttons <= 3.43 - Missing AuthorizationEPSS 0.4%CVE-2025-4339MEDIUMTheGem <= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options UpdateEPSS 0.4%CVE-2025-13930MEDIUMCheckout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment DeletionEPSS 0.4%CVE-2024-37935HIGHWordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2026-71509HIGHDolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update EndpointEPSS 0.4%CVE-2026-7523MEDIUMAlba Board <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'card_id' ParameterEPSS 0.4%CVE-2026-53769MEDIUMAvo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyEPSS 0.4%CVE-2023-33998MEDIUMWordPress Easy Social Icons plugin <= 3.2.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-32226MEDIUMWordPress Display product variations dropdown on shop page plugin <= 1.1.3 - Broken Access Control vulnerabilityEPSS 0.4%