Weaknesses of type CWE-862

8,626 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-4977MEDIUMUsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' ParameterEPSS 0.4%CVE-2026-65931MEDIUMLimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpointEPSS 0.4%CVE-2026-22765HIGHDell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. A low privileged attacker with remote EPSS 0.4%CVE-2025-24613MEDIUMWordPress FV Thoughtful Comments plugin <= 0.3.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2022-38141MEDIUMWordPress Sales Report Email for WooCommerce Plugin <= 2.8 is vulnerable to Broken Access ControlEPSS 0.4%CVE-2025-49996MEDIUMWordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-60118MEDIUMHi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation EndpointEPSS 0.4%CVE-2026-8692MEDIUMVedrixa Forms <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX ActionEPSS 0.4%CVE-2026-10782MEDIUMRealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX ActionEPSS 0.4%CVE-2026-13110MEDIUMStoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX ActionEPSS 0.4%CVE-2025-47564MEDIUMWordPress EventON plugin <= 4.9.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-9766MEDIUMEmpik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX ActionEPSS 0.4%CVE-2021-47932CRITICALWordPress TheCartPress 1.5.3.6 Privilege Escalation UnauthenticatedEPSS 0.4%CVE-2026-8682MEDIUM3D Viewer <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpointEPSS 0.4%CVE-2026-9199MEDIUMEqualize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' ParameterEPSS 0.4%CVE-2025-49181HIGHConfigurations endpoint does not require authorizationEPSS 0.4%CVE-2026-16774MEDIUMWPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX ActionEPSS 0.4%CVE-2026-4604MEDIUMKlubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings UpdateEPSS 0.4%CVE-2025-24693MEDIUMWordPress Advanced Notifications plugin <= 1.2.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2022-3320MEDIUMBypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint commandEPSS 0.4%