Weaknesses of type CWE-862

8,621 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-47125HIGHArcane: Missing admin authorization on global variables endpointEPSS 0.4%CVE-2026-67621HIGHFlowise 3.1.4 Missing Authorization on Document Store Mutation EndpointsEPSS 0.4%CVE-2026-18650HIGHMissing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYSEPSS 0.4%CVE-2026-68587CRITICALSiYuan before v3.7.3 Information Disclosure via getHeading*TransactionEPSS 0.4%CVE-2026-11354MEDIUMParticipants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' ParameterEPSS 0.4%CVE-2025-26661HIGHMissing Authorization check in SAP NetWeaver (ABAP Class Builder)EPSS 0.4%CVE-2026-70487MEDIUMOpen WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadataEPSS 0.4%CVE-2025-31533MEDIUMWordPress Salesmate Add-On for Gravity Forms plugin <= 2.0.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-46196MEDIUMWordPress Social proof testimonials and reviews by Repuso plugin <= 4.97 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-26968HIGHWordPress Cloak Front End Email <= 1.9.5 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2026-48709LOWOliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument EnumerationEPSS 0.4%CVE-2026-6222MEDIUMForminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' ParameterEPSS 0.4%CVE-2024-13654HIGHZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options DeletionEPSS 0.4%CVE-2024-39664HIGHWordPress Filter & Grids plugin <= 2.8.32 - Broken Authentication vulnerabilityEPSS 0.4%CVE-2025-58073HIGHArbitrary Mattermost Team can be joined by manipulating the OAuth stateEPSS 0.4%CVE-2026-12349MEDIUMPremium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actionsEPSS 0.4%CVE-2026-5347MEDIUMWP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' ParameterEPSS 0.4%CVE-2023-46188MEDIUMWordPress Freesoul Deactivate Plugins plugin <= 2.1.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-73265MEDIUMRustFS: Version-specific object reads authorize the non-version actionEPSS 0.4%CVE-2026-57776MEDIUMWordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerabilityEPSS 0.4%