Weaknesses of type CWE-862

8,661 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-21527MEDIUMVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Design Tools SEC). Supported versions that areEPSS 0.4%CVE-2026-35175HIGHAjenti has an authorization bypass during custom package installationEPSS 0.4%CVE-2024-43312MEDIUMWordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.1.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-7068MEDIUMWooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order ExportEPSS 0.4%CVE-2025-24974HIGHDataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read VulnerabilityEPSS 0.4%CVE-2026-18030HIGHBricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro FormsEPSS 0.4%CVE-2026-81901HIGHConcrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpointEPSS 0.4%CVE-2025-39532HIGHWordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-31628MEDIUMWordPress Sliced Invoices plugin <= 3.10.0 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2025-31866MEDIUMWordPress ShipDepot for WooCommerce plugin <= 1.2.19 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-26975MEDIUMWordPress Strong Testimonials plugin <= 3.2.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-32678MEDIUMWordPress TrackShip for WooCommerce plugin <= 1.7.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-2933HIGHEmail Notifications for Updates <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.4%CVE-2025-59011HIGHWordPress Traveler Theme < 3.2.3 - Arbitrary Content Deletion VulnerabilityEPSS 0.4%CVE-2024-24835MEDIUMWordPress BEAR plugin <= 1.1.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-32316HIGHUsers can add themselves to any organization in CloudExplorer LiteEPSS 0.4%CVE-2023-28165MEDIUMWordPress Backup Bank: WordPress Backup Plugin plugin <= 4.0.28 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-8322HIGHVentem｜e-School - Missing AuthorizationEPSS 0.4%CVE-2023-41296—Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect integrity and confidenEPSS 0.4%CVE-2026-44765HIGHMissing Authorization Check in SAP Manufacturing Integration and IntelligenceEPSS 0.4%