Weaknesses of type CWE-862

8,469 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2021-22896—Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to creEPSS 1.0%CVE-2022-0163—Smart Forms < 2.6.71 - Subscriber+ Form Data DownloadEPSS 1.0%CVE-2023-50976CRITICALRedpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API.EPSS 1.0%CVE-2021-32748MEDIUMWOPI API not protected by credentials/IP checkEPSS 1.0%CVE-2023-33477MEDIUMIn Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path.EPSS 1.0%CVE-2025-6441CRITICALWebinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 4.03.32 - Unauthenticated Login Token Generation to Authentication BypassEPSS 1.0%CVE-2024-52382CRITICALWordPress Matix Popup Builder plugin <= 1.0.0 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 1.0%CVE-2024-6500CRITICALInPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and DeleteEPSS 1.0%CVE-2024-50490CRITICALWordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 1.0%CVE-2020-3400HIGHCisco IOS XE Software Web UI Authorization Bypass VulnerabilityEPSS 1.0%CVE-2023-50944MEDIUMApache Airflow: Bypass permission verification to read code of other dagsEPSS 1.0%CVE-2020-5228HIGHOpencast allows unauthorized public access via OAI-PMHEPSS 1.0%CVE-2026-54568MEDIUMMicrosoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_infoEPSS 1.0%CVE-2026-1499HIGHWP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX ActionEPSS 1.0%CVE-2025-30448CRITICALThis issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 1EPSS 1.0%CVE-2026-57131CRITICALpraisonai: Jobs API exposes agent-execution endpoints with no authenticationEPSS 1.0%CVE-2022-41228HIGHA missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/ReaEPSS 1.0%CVE-2022-41234HIGHJenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/ReadEPSS 1.0%CVE-2026-11801HIGHWPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST EndpointEPSS 1.0%CVE-2023-47179HIGHWordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerabilityEPSS 1.0%