Weaknesses of type CWE-862

8,657 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-54847HIGHWordPress Stylish Cost Calculator plugin <= 8.3.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-45209HIGHWordPress MyCryptoCheckout plugin <= 2.161 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-46247MEDIUMWordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2026-9616MEDIUMGenerate Security.txt <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX ActionEPSS 0.4%CVE-2026-8688MEDIUMAdvance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX ActionEPSS 0.4%CVE-2026-52711HIGHWordPress WooCommerce POS plugin <= 1.8.14 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-32472HIGHWordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-84821HIGHWordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-74021HIGHWordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-32495HIGHWordPress WP Terms Popup plugin <= 2.10.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-19948MEDIUMCozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' ParameterEPSS 0.4%CVE-2026-55433MEDIUMCoder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containersEPSS 0.4%CVE-2024-43215MEDIUMWordPress Social Slider Feed plugin <= 2.2.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-83628MEDIUMTheme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup StageEPSS 0.4%CVE-2023-51499MEDIUMWordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-9237MEDIUMEmployee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX ActionEPSS 0.4%CVE-2026-28567HIGHWordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-40870HIGHDecidim's comments API allows access to all commentable resourcesEPSS 0.4%CVE-2026-64814HIGHIn JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development sessionEPSS 0.4%CVE-2024-54227MEDIUMWordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerabilityEPSS 0.4%