Weaknesses of type CWE-862

8,470 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-42613CRITICALGrav: Privilege Escalation via Missing Server-Side Validation of groups/accessEPSS 0.9%CVE-2024-2417HIGHUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 0.9%CVE-2017-2662MEDIUMA flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filteEPSS 0.9%CVE-2023-0923HIGHOdh-notebook-controller-container: missing authorization allows for file contents disclosureEPSS 0.9%CVE-2022-23621MEDIUMMissing authorization in xwiki-platformEPSS 0.9%CVE-2023-3244MEDIUMComments Like Dislike <= 1.2.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting ResetEPSS 0.9%CVE-2022-41797MEDIUMImproper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iEPSS 0.9%CVE-2013-3703HIGHNo write permission check in change_role commandEPSS 0.9%CVE-2022-32768MEDIUMMultiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7cEPSS 0.9%CVE-2023-4723MEDIUMElementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information ExposureEPSS 0.9%CVE-2021-44795MEDIUMModifying User Permissions via Unauthorized Access in Single ConnectEPSS 0.9%CVE-2021-24639—OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder DeletionEPSS 0.9%CVE-2024-54239CRITICALWordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 0.9%CVE-2024-3895HIGHWP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.9%CVE-2026-57205MEDIUMSimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpointsEPSS 0.9%CVE-2026-4812MEDIUMAdvanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query ParametersEPSS 0.9%CVE-2024-11270HIGHWordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File CreationEPSS 0.9%CVE-2024-3295MEDIUMUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media DeletionEPSS 0.9%CVE-2025-55142HIGHMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.EPSS 0.9%CVE-2024-0593MEDIUMSimple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information DisclosureEPSS 0.9%