Weaknesses of type CWE-862

8,605 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-31691CRITICALOAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020EPSS 0.4%CVE-2025-13498MEDIUMDownload Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password DisclosureEPSS 0.4%CVE-2024-37516MEDIUMWordPress Featured Image from URL (FIFU) plugin <= 4.8.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-27405MEDIUMWordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-33093MEDIUMAnviz Products Missing AuthorizationEPSS 0.4%CVE-2026-56104HIGHChainlit < 2.10.1 Session Hijacking via WebSocket Session RestorationEPSS 0.4%CVE-2026-85395HIGHUnoPim before 2.1.3 Missing Authorization on Integration Management RoutesEPSS 0.4%CVE-2026-5228HIGHImproper Access Control in Kurt Software Studio's WriteUp Mobile AppEPSS 0.4%CVE-2026-75339HIGHThe storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, anEPSS 0.4%CVE-2024-30465MEDIUMWordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-62940CRITICALIncus has a project restriction bypass via instance migration config overrideEPSS 0.4%CVE-2026-44442CRITICALERPNext: Unauthorised Document modification due to missing validationEPSS 0.4%CVE-2024-33543HIGHWordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-3524HIGHAuthorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission CheckEPSS 0.4%CVE-2026-18650HIGHMissing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYSEPSS 0.4%CVE-2026-47125HIGHArcane: Missing admin authorization on global variables endpointEPSS 0.4%CVE-2026-56038HIGHWordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2026-88271HIGHGV-LPC2011/LPC2211 - SSVR Guest Configuration Overwrite and Administrative Credential TakeoverEPSS 0.4%CVE-2026-28424MEDIUMStatamic's missing authorization allows access to email addressesEPSS 0.4%CVE-2024-33555HIGHWordPress XStore Core plugin <= 5.3.8 - Multiple Authenticated Broken Access Control vulnerabilityEPSS 0.4%