Weaknesses of type CWE-862

8,470 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-0593MEDIUMSimple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information DisclosureEPSS 0.9%CVE-2025-55141HIGHMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.EPSS 0.9%CVE-2026-48168CRITICALPraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch nameEPSS 0.9%CVE-2020-1996MEDIUMPAN-OS: Panorama management server log injectionEPSS 0.9%CVE-2026-32230MEDIUMUptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status pageEPSS 0.9%CVE-2025-2807HIGHMotors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin InstallationEPSS 0.9%CVE-2026-53633CRITICALVitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCEEPSS 0.9%CVE-2026-27454MEDIUMDiscourse has check revision visibility on posts endpointEPSS 0.9%CVE-2026-74909HIGHKeycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segmentsEPSS 0.9%CVE-2026-1314MEDIUM3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data ExposureEPSS 0.9%CVE-2025-13956MEDIUMLearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics ExposureEPSS 0.9%CVE-2024-1991HIGHRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.9%CVE-2026-4003CRITICALUsers manager – PN <= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX ActionEPSS 0.9%CVE-2022-27658—Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information EPSS 0.9%CVE-2021-4331HIGHThe Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege EscalationEPSS 0.9%CVE-2023-53740HIGHScreen SFT DAB 1.9.3 Authentication Bypass via Admin Password ChangeEPSS 0.9%CVE-2021-4359MEDIUMFrontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post DeletionEPSS 0.9%CVE-2024-0138CRITICALNVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful exploit of this vulnerabEPSS 0.9%CVE-2023-3714HIGHProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege EscalationEPSS 0.9%CVE-2026-4365CRITICALLearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer DeletionEPSS 0.9%