Weaknesses of type CWE-862

8,659 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-43154MEDIUMWordPress Advanced Cron Manager – debug & control plugin <= 2.5.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-39513HIGHWordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-32549HIGHWordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-13316MEDIUMScratch & Win – Giveaways and Contests <= 2.8.0 - Missing Authorization to Unauthenticated Coupon CreationEPSS 0.4%CVE-2024-27900MEDIUMMissing Authorization check in SAP ABAP PlatformEPSS 0.4%CVE-2024-34371MEDIUMWordPress Login with phone number plugin <= 1.7.18 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-56276MEDIUMWordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-92992MEDIUMDromara mayfly-go AI Assistant ai.go authorizationEPSS 0.4%CVE-2026-68533LOWMissing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments PermissionEPSS 0.4%CVE-2024-47314HIGHWordPress Sunshine Photo Cart plugin <= 3.2.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-47788MEDIUMWordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-24703HIGHWordPress MultiVendorX plugin <= 4.0.25 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-42982HIGHInformation Disclosure in SAP GRC (AC Plugin)EPSS 0.4%CVE-2026-81908MEDIUMMissing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All GroupsEPSS 0.4%CVE-2024-1175MEDIUMWP-Recall – Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_paymentEPSS 0.4%CVE-2025-32624HIGHWordPress Czater.pl – live chat i telefon plugin <= 1.0.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9109MEDIUMUPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key resetEPSS 0.4%CVE-2025-31720MEDIUMA missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withouEPSS 0.4%CVE-2024-37204MEDIUMWordPress PropertyHive plugin <= 2.0.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-7727MEDIUMHTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handlerEPSS 0.4%