Weaknesses of type CWE-862

8,688 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-52183MEDIUMWordPress WordPress Backup & Migration plugin <= 1.4.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-68003MEDIUMWordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerabilityEPSS 0.4%CVE-2025-22657HIGHWordPress Atarim plugin <= 4.0.9 - Arbitrary Content Deletion vulnerabilityEPSS 0.4%CVE-2025-26959HIGHWordPress Administrator Z <= 2025.03.24 - Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-49741HIGHTYPO3 CMS - Privilege Escalation & SQL Injection in Form FrameworkEPSS 0.4%CVE-2025-11877HIGHUser Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed LoginEPSS 0.4%CVE-2025-26741HIGHWordPress Email Notifications for Updates <= 1.1.6 - Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-39533HIGHWordPress Starfish Review Generation & Marketing plugin <= 3.1.19 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2026-57619MEDIUMWordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2025-13620MEDIUMWp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter TamperingEPSS 0.4%CVE-2021-24790—Contact Form Advanced Database <= 1.0.8 - Unauthorised AJAX CallsEPSS 0.4%CVE-2025-12934HIGHBeaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post UpdateEPSS 0.4%CVE-2025-22265MEDIUMWordPress EMI Calculator plugin <= 1.1 - Settings Change vulnerabilityEPSS 0.4%CVE-2024-33586MEDIUMWordPress Photo Gallery by 10Web plugin <= 1.8.20 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-42142HIGHTypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential AccessEPSS 0.4%CVE-2025-32684MEDIUMWordPress MapSVG Lite plugin <= 8.6.4 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2024-2036MEDIUMApplyOnline – Application Form Builder and Manager <= 2.6.2 - Missing Authorization to Sensitive Information ExposureEPSS 0.4%CVE-2026-59704HIGHCap - Missing Access Control in Video AI Metadata EndpointEPSS 0.4%CVE-2023-2494MEDIUMGo Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege GrantingEPSS 0.4%CVE-2024-22272MEDIUMVMware Cloud Director contains an Improper Privilege Management vulnerability. An authenticated tenant administrator for a given organizEPSS 0.4%