Weaknesses of type CWE-862

8,628 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-16471HIGHBroken Access Control in Dolusoft Software's SonloggerEPSS 0.4%CVE-2023-29174MEDIUMWordPress SKU Label Changer For WooCommerce plugin <= 3.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-89138MEDIUMFilter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX ActionEPSS 0.4%CVE-2026-74020HIGHWordPress Koji theme <= 2.2.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-42677HIGHWordPress WP Document Revisions plugin <= 3.8.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-28571HIGHWordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-39534HIGHWordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-39513HIGHWordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-27374HIGHWordPress WooCommerce Order Details plugin <= 3.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-80433HIGHWordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2022-3337MEDIUMLock WARP switch bypass by removing VPN profile on iOS mobile clientEPSS 0.4%CVE-2022-3321MEDIUMLock WARP switch feature bypass on WARP mobile client for iOSEPSS 0.4%CVE-2026-66441HIGHWordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-64814HIGHIn JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development sessionEPSS 0.4%CVE-2024-34377MEDIUMWordPress Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery plugin <= 1.5.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-89406HIGHModula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' ParametersEPSS 0.4%CVE-2026-39490HIGHWordPress JupiterX Core plugin <= 4.14.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-83628MEDIUMTheme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup StageEPSS 0.4%CVE-2026-61943HIGHWordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-54837HIGHWordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerabilityEPSS 0.4%