Weaknesses of type CWE-862

8,660 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-61595HIGHdjust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' dataEPSS 0.4%CVE-2024-6465MEDIUMWP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image UpdateEPSS 0.4%CVE-2026-16544MEDIUMAwx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosureEPSS 0.4%CVE-2025-22800MEDIUMWordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-75908MEDIUMNewsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST ParameterEPSS 0.4%CVE-2026-79666HIGHEch0 before 4.4.3 Missing Authorization via dashboard log endpointsEPSS 0.4%CVE-2026-4607MEDIUMProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings ModificationEPSS 0.4%CVE-2023-46606MEDIUMWordPress AtomChat plugin <= 1.1.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-16587MEDIUMAdvanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() FunctionEPSS 0.4%CVE-2026-24525MEDIUMWordPress CLP Varnish Cache plugin <= 1.0.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-89055CRITICALCustomer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' ParameterEPSS 0.4%CVE-2026-15350MEDIUMThe Cache Purger <= 2.3.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' ParameterEPSS 0.4%CVE-2026-49205MEDIUMphpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)EPSS 0.4%CVE-2022-45830MEDIUMWordPress Analytify - Google Analytics Dashboard plugin <= 4.2.3 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2023-6876MEDIUMClever Fox – One Click Website Importer by Nayra Themes <= 25.2.0 - Missing Authorization to arbitrary theme activation via clever-fox-activate-themeEPSS 0.4%CVE-2024-13423MEDIUMSparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/DeactivationEPSS 0.4%CVE-2025-1279HIGHBM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.4%CVE-2024-30470MEDIUMWordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-45244LOWSummarize < 0.15.1 Unapproved Browser Automation ExecutionEPSS 0.4%CVE-2026-22680MEDIUMOpenViking < 0.3.3 Missing Authorization via Task PollingEPSS 0.4%