Weaknesses of type CWE-862

8,626 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-42439MEDIUMOpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action RoutesEPSS 0.4%CVE-2026-67262HIGHDell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability toEPSS 0.4%CVE-2024-38794MEDIUMWordPress Custom Query Blocks plugin <= 5.2.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-22717HIGHWordPress My Tickets plugin <= 2.0.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-3063HIGHShopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.4%CVE-2026-2381MEDIUMWooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' ParameterEPSS 0.4%CVE-2023-31234MEDIUMWordPress Tilda Publishing plugin <= 0.3.23 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-27449MEDIUMWordPress Total Poll Lite plugin <= 4.8.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-29237MEDIUMWordPress Remove Duplicate Posts plugin <= 1.3.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-37411MEDIUMWordPress Progress Planner plugin <= 0.9.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-48257MEDIUMWordPress Projectopia plugin <= 5.1.17 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2026-34024HIGHMissing authorization checks in Wertheim SafeController Software allow low-privileged users to access restricted functionsEPSS 0.4%CVE-2024-32691MEDIUMWordPress Active Products Tables for WooCommerce plugin <= 1.0.6.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-55095MEDIUMOpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fieldsEPSS 0.4%CVE-2026-86271MEDIUMFluentCMS PermissionManager.cs GetAccessible authorizationEPSS 0.4%CVE-2026-32905HIGHOpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat CommandEPSS 0.4%CVE-2026-72664MEDIUMMissing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response ActionsEPSS 0.4%CVE-2025-49829MEDIUMConjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validationsEPSS 0.4%CVE-2024-37269MEDIUMWordPress Masterstudy Elementor Widgets plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-46644MEDIUMWordPress WordPress CTA plugin <= 1.5.8 - Broken Access Control vulnerabilityEPSS 0.4%