Weaknesses of type CWE-862

8,626 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-16285HIGHWooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media DownloadEPSS 0.4%CVE-2024-1385HIGHWP-Stateless – Google Cloud Storage <= 3.4.0 - Missing Authorization to Limited Arbitrary Options UpdateEPSS 0.4%CVE-2024-1771MEDIUMTotal <= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections UpdateEPSS 0.4%CVE-2026-90941MEDIUMnovel-plus through 5.3.3 Missing Authorization on the Admin Book Download EndpointEPSS 0.4%CVE-2026-77141HIGHBroken Access Control in extension "Club Directory" (clubdirectory)EPSS 0.4%CVE-2026-77143HIGHBroken Access Control in extension "Forum" (pforum)EPSS 0.4%CVE-2026-87537HIGHMissing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proceEPSS 0.4%CVE-2026-12082HIGHPraison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure)EPSS 0.4%CVE-2026-77142HIGHBroken Access Control in extension "Industry Directory" (yellowpages2)EPSS 0.4%CVE-2024-5710MEDIUMImproper Access Control in Team Management in berriai/litellmEPSS 0.4%CVE-2024-10399MEDIUMDownload Monitor <= 5.0.13 - Missing Authorization to Sensitive Information ExposureEPSS 0.4%CVE-2023-6742MEDIUMEnvira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_imagesEPSS 0.4%CVE-2026-12710CRITICALMissing Authorization in Application Integration QueryEngineTaskEPSS 0.4%CVE-2024-32804MEDIUMWordPress WP GoToWebinar plugin <= 14.46 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-4566HIGHShopLentor <= 2.8.8 - Missing Authorization to WordPress Option ModificationEPSS 0.4%CVE-2026-78069CRITICALJoomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6EPSS 0.4%CVE-2026-12434MEDIUMList category posts <= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode AttributeEPSS 0.4%CVE-2024-37094HIGHWordPress MasterStudy LMS plugin <= 3.2.12 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-18789HIGHEzoic < 2.23.1 - Unauthenticated Database Export via Content Export REST RoutesEPSS 0.4%CVE-2022-45349MEDIUMWordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerabilityEPSS 0.4%