Weaknesses of type CWE-862

8,661 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-23611MEDIUMxblock-lti-consumer contain Missing Authorization in Grade Pass Back ImplementationEPSS 0.4%CVE-2025-69052CRITICALWordPress Registration & Login with Mobile Phone Number for WooCommerce plugin <= 1.3.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-22680MEDIUMOpenViking < 0.3.3 Missing Authorization via Task PollingEPSS 0.4%CVE-2024-3942MEDIUMMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing AuthorizationEPSS 0.4%CVE-2026-2001HIGHWowRevenue <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/ActivationEPSS 0.4%CVE-2026-45244LOWSummarize < 0.15.1 Unapproved Browser Automation ExecutionEPSS 0.4%CVE-2026-82273HIGHMastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is UnsetEPSS 0.4%CVE-2026-73326HIGHCamaleonCMS Missing Authorization via Plugin Administration EndpointsEPSS 0.4%CVE-2026-81823MEDIUMAVEVA Pipeline Integrity Monitor Missing AuthorizationEPSS 0.4%CVE-2024-13423MEDIUMSparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/DeactivationEPSS 0.4%CVE-2024-43928MEDIUMWordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-18201MEDIUMKeycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizationsEPSS 0.4%CVE-2026-27377MEDIUMWordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-65021CRITICALRallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)EPSS 0.4%CVE-2025-10212MEDIUMSiteAlert (Formerly WP Health) <= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information ExposureEPSS 0.4%CVE-2025-21527MEDIUMVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Design Tools SEC). Supported versions that areEPSS 0.4%CVE-2025-15390MEDIUMPHPGurukul Small CRM edit-user.php authorizationEPSS 0.4%CVE-2024-1717MEDIUMAdmin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email RetrievalEPSS 0.4%CVE-2025-32620HIGHWordPress Doppler Forms plugin <= 2.4.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-35175HIGHAjenti has an authorization bypass during custom package installationEPSS 0.4%