Weaknesses of type CWE-862

8,467 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2022-0588HIGHMissing Authorization in librenms/librenmsEPSS 1.1%CVE-2024-33566CRITICALWordPress OrderConvo plugin <= 12.4 - Unauthenticated API Access to Arbitrary File Upload vulnerabilityEPSS 1.1%CVE-2026-14245CRITICALminiOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' ParameterEPSS 1.1%CVE-2024-55879CRITICALXWiki allows RCE from script right in configurable sectionsEPSS 1.1%CVE-2025-1304HIGHNewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.1%CVE-2023-20252CRITICALA vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticatEPSS 1.1%CVE-2021-41803HIGHHashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage EPSS 1.1%CVE-2024-38190HIGHPower Platform Information Disclosure VulnerabilityEPSS 1.1%CVE-2022-1511MEDIUMMissing Authorization in snipe/snipe-itEPSS 1.1%CVE-2025-46554MEDIUMXWiki missing authorization when accessing the wiki level attachments list and metadata via REST APIEPSS 1.1%CVE-2026-44595MEDIUMYamcs: Unauthorized user enumeration via IAM API endpointsEPSS 1.1%CVE-2024-37901CRITICALXWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheetEPSS 1.1%CVE-2022-0579MEDIUMMissing Authorization in snipe/snipe-itEPSS 1.1%CVE-2023-30581HIGHThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.jsoEPSS 1.1%CVE-2026-23537CRITICALFeast: unauthenticated arbitrary file writeEPSS 1.0%CVE-2025-5888MEDIUMjsnjfz WebStack-Guns cross-site request forgeryEPSS 1.0%CVE-2021-36225HIGHWestern Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uEPSS 1.0%CVE-2018-10866—It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthentiEPSS 1.0%CVE-2021-44055MEDIUMInformation leakage in Video StationEPSS 1.0%CVE-2024-30485HIGHWordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerabilityEPSS 1.0%