Weaknesses of type CWE-862

8,660 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-6621MEDIUMWP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State UpdateEPSS 0.4%CVE-2024-31352MEDIUMWordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-36512MEDIUMWordPress AutomateWoo plugin <= 5.7.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-4948MEDIUMWooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR UpdateEPSS 0.4%CVE-2023-2174MEDIUMBadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entriesEPSS 0.4%CVE-2023-2284MEDIUMWP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_dbEPSS 0.4%CVE-2024-1779MEDIUMAdmin side data storage for Contact Form 7 plugin <= 1.1.1 - Missing Authorization to Unauthenticated Read Status UpdateEPSS 0.4%CVE-2026-89023HIGHThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST APIEPSS 0.4%CVE-2026-89055CRITICALCustomer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' ParameterEPSS 0.4%CVE-2026-75908MEDIUMNewsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST ParameterEPSS 0.4%CVE-2026-24525MEDIUMWordPress CLP Varnish Cache plugin <= 1.0.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-6465MEDIUMWP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image UpdateEPSS 0.4%CVE-2026-34836MEDIUMCombodo iTop: Improper access control in ajax.render.php and ajax.document.phpEPSS 0.4%CVE-2024-31230MEDIUMWordPress ShortPixel Adaptive Images plugin <= 3.8.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-22800MEDIUMWordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-48492MEDIUMSnipe-IT's selectlist visibility is too permissiveEPSS 0.4%CVE-2026-1946MEDIUMGW AI Website Builder <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings DeletionEPSS 0.4%CVE-2026-16779MEDIUMKubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX ActionEPSS 0.4%CVE-2023-46608MEDIUMWordPress DoLogin Security plugin <= 3.7.1 - Multiple Broken Access Control vulnerabilityEPSS 0.4%CVE-2022-24669MEDIUMAnonymous users can register / de-register for configuration change notificationsEPSS 0.4%