Weaknesses of type CWE-862

8,674 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-2619MEDIUMElementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML InjectionEPSS 0.4%CVE-2025-58753MEDIUMcopyparty: Sharing a single file does not fully restrict access to other files in source folderEPSS 0.4%CVE-2025-30916MEDIUMWordPress Residential Address Detection plugin <= 2.5.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2022-48302HIGHThe AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data EPSS 0.4%CVE-2026-48088CRITICALOpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directoryEPSS 0.4%CVE-2026-0490HIGHDenial of service (DOS) in SAP BusinessObjects BI PlatformEPSS 0.4%CVE-2025-24581MEDIUMWordPress Instantio plugin <= 3.3.7 - Settings Change vulnerabilityEPSS 0.4%CVE-2025-23958MEDIUMWordPress Editor Wysiwyg Background Color plugin <= 1.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-34369MEDIUMAVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password VerificationEPSS 0.4%CVE-2025-30915MEDIUMWordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.19 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-14982MEDIUMBooking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information ExposureEPSS 0.4%CVE-2024-9202MEDIUMEDC DataSetResolver policy filtering missingEPSS 0.4%CVE-2026-92753HIGHPatrowlManager through 1.8.4 Authorization Bypass via Events APIEPSS 0.4%CVE-2023-27460MEDIUMWordPress CP Contact Form with PayPal plugin <= 1.3.34 - Missing Authorization Leading To Feedback Submission vulnerabilityEPSS 0.4%CVE-2024-47317MEDIUMWordPress Ads by WPQuads plugin <= 2.0.84 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-31721MEDIUMA missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withouEPSS 0.4%CVE-2026-24363HIGHWordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-10871LOWMissing Authorization in GitLabEPSS 0.4%CVE-2026-45438HIGHWordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-46632HIGHWordPress My Shortcodes plugin <= 2.3 - Broken Access Control vulnerabilityEPSS 0.4%