Weaknesses of type CWE-862

8,660 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-5385MEDIUMFunnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post DuplicationEPSS 0.4%CVE-2023-5411MEDIUMFunnelforms Free <= 3.4 - Missing Authorization to Post ModificationEPSS 0.4%CVE-2026-84757HIGHWordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerabilityEPSS 0.4%CVE-2023-5314MEDIUMWP EXtra <= 6.2 - Missing Authorization to Arbitrary Email SendingEPSS 0.4%CVE-2024-43285MEDIUMWordPress Presto Player plugin <= 3.0.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-45399HIGHOpen WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruptionEPSS 0.4%CVE-2024-43146MEDIUMWordPress Accelerated Mobile Pages plugin <= 1.0.96.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-31720MEDIUMA missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withouEPSS 0.4%CVE-2024-7727MEDIUMHTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handlerEPSS 0.4%CVE-2024-37204MEDIUMWordPress PropertyHive plugin <= 2.0.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-43567HIGHOpenClaw < 2026.4.10 - Path Traversal in screen_record outPath ParameterEPSS 0.4%CVE-2024-4010HIGHEmail Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_requestEPSS 0.4%CVE-2024-12300LOWAR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File UploadEPSS 0.4%CVE-2023-5419MEDIUMFunnelforms Free <= 3.4 - Missing Authorization to Test Email SendingEPSS 0.4%CVE-2026-3906MEDIUMWordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST APIEPSS 0.4%CVE-2026-57688HIGHWordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2022-36352MEDIUMWordPress ProfileGrid Plugin <= 5.0.3 is vulnerable to Broken Access ControlEPSS 0.4%CVE-2026-96896HIGHMalcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_requestEPSS 0.4%CVE-2026-5693MEDIUMSmart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking CancellationEPSS 0.4%CVE-2023-1903MEDIUMMissing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0)EPSS 0.4%