Weaknesses of type CWE-862

8,605 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-75017MEDIUMMagazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST EndpointEPSS 0.4%CVE-2026-24530MEDIUMWordPress WebP Conversion plugin <= 2.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-37087CRITICALA vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary filEPSS 0.4%CVE-2023-47183MEDIUMWordPress GiveWP plugin <= 2.33.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2021-4445MEDIUMPremium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option UpdateEPSS 0.4%CVE-2026-5025MEDIUMLangflow - Application Logs Exposed to All Authenticated UsersEPSS 0.4%CVE-2026-77146HIGHBroken Access Control in extension "femanager" (femanager)EPSS 0.4%CVE-2024-12881HIGHPlugVersions – Easily rollback to previous versions of your plugins <= 0.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File CreationEPSS 0.4%CVE-2026-9619MEDIUMReviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX ActionEPSS 0.4%CVE-2026-32648MEDIUMAnviz Products Missing AuthorizationEPSS 0.4%CVE-2026-15930CRITICALSimple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username CollisionEPSS 0.4%CVE-2025-31691CRITICALOAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020EPSS 0.4%CVE-2026-3477MEDIUMPZ Frontend Manager <= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' ParameterEPSS 0.4%CVE-2026-4117MEDIUMCalJ <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' ActionEPSS 0.4%CVE-2024-36113MEDIUMDiscourse missing authorization checks for suspending admins/moderatorsEPSS 0.4%CVE-2026-16057MEDIUMContest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_libraryEPSS 0.4%CVE-2026-16038CRITICALMStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment GatewaysEPSS 0.4%CVE-2024-52395MEDIUMWordPress Floating Buttons for WooCommerce plugin <= 2.8.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-33093MEDIUMAnviz Products Missing AuthorizationEPSS 0.4%CVE-2025-3124MEDIUMMissing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository namesEPSS 0.4%