Weaknesses of type CWE-862

8,628 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-43215MEDIUMWordPress Social Slider Feed plugin <= 2.2.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-64814HIGHIn JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development sessionEPSS 0.4%CVE-2026-16467HIGHBroken Access Control in Dolusoft Software's FortiloggerEPSS 0.4%CVE-2024-1639MEDIUMLicense Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information ExposureEPSS 0.4%CVE-2026-54846HIGHWordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-54837HIGHWordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-32495HIGHWordPress WP Terms Popup plugin <= 2.10.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-25953MEDIUMSerosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token expEPSS 0.4%CVE-2026-65551HIGHWordPress Breakdance plugin < 2.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-54847HIGHWordPress Stylish Cost Calculator plugin <= 8.3.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-40776HIGHWordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-85213HIGHKill Bill through 0.24.21 Missing Authorization on AdminResource EndpointsEPSS 0.4%CVE-2026-49057HIGHWordPress JobSearch plugin <= 3.2.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-65500HIGHWordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-1657MEDIUMEventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX EndpointEPSS 0.4%CVE-2026-57729HIGHWordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-42666HIGHWordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-61943HIGHWordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-65504HIGHWordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-74020HIGHWordPress Koji theme <= 2.2.1 - Broken Access Control vulnerabilityEPSS 0.4%