Weaknesses of type CWE-862

10,119 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-15991HIGHFile Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query ParameterEPSS 1.1%CVE-2026-14245CRITICALminiOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' ParameterEPSS 1.1%CVE-2022-0588HIGHMissing Authorization in librenms/librenmsEPSS 1.1%CVE-2024-33566CRITICALWordPress OrderConvo plugin <= 12.4 - Unauthenticated API Access to Arbitrary File Upload vulnerabilityEPSS 1.1%CVE-2026-0692HIGHBlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status ManipulationEPSS 1.1%CVE-2021-41803HIGHHashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage EPSS 1.1%CVE-2025-46554MEDIUMXWiki missing authorization when accessing the wiki level attachments list and metadata via REST APIEPSS 1.1%CVE-2024-55879CRITICALXWiki allows RCE from script right in configurable sectionsEPSS 1.1%CVE-2024-38190HIGHPower Platform Information Disclosure VulnerabilityEPSS 1.1%CVE-2022-1511MEDIUMMissing Authorization in snipe/snipe-itEPSS 1.1%CVE-2021-44055MEDIUMInformation leakage in Video StationEPSS 1.1%CVE-2026-44595MEDIUMYamcs: Unauthorized user enumeration via IAM API endpointsEPSS 1.1%CVE-2024-37901CRITICALXWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheetEPSS 1.1%CVE-2025-24181CRITICALA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturEPSS 1.1%CVE-2022-0579MEDIUMMissing Authorization in snipe/snipe-itEPSS 1.1%CVE-2025-1639HIGHAnimation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/ActivationEPSS 1.1%CVE-2023-30581HIGHThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.jsoEPSS 1.1%CVE-2026-23537CRITICALFeast: unauthenticated arbitrary file writeEPSS 1.0%CVE-2021-36225HIGHWestern Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uEPSS 1.0%CVE-2018-10866—It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthentiEPSS 1.0%