Weaknesses of type CWE-862

8,689 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-19350MEDIUMDolibarr ERP TakePOS invoice.php fail authorizationEPSS 0.4%CVE-2026-3977MEDIUMprojectsend AJAX Endpoints authorizationEPSS 0.4%CVE-2024-34815MEDIUMWordPress Import and export users and customers plugin <= 1.26.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-43331MEDIUMWordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-31421MEDIUMWordPress Popup by Supsystic plugin <= 1.10.27 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-51494MEDIUMWordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-29000HIGHWordPress Multi-language Responsive Contact Form plugin <= 2.8 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2025-46823HIGHOpenMRS has Vulnerability in FHIR2 Module PrivilegesEPSS 0.4%CVE-2024-33545MEDIUMWordPress WZone plugin <= 14.0.10 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-37123MEDIUMWordPress Ibtana – WordPress Website Builder plugin <= 1.2.3.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-54692HIGHWordPress Membership For WooCommerce Plugin <= 2.9.0 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2024-30544MEDIUMWordPress Whizzy plugin <= 1.1.18 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-27638MEDIUMActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user modeEPSS 0.4%CVE-2025-52731HIGHWordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Arbitrary Content Deletion VulnerabilityEPSS 0.4%CVE-2024-5459MEDIUMRestaurant Menu and Food Ordering <= 2.4.16 - Missing Authorization to Menu CreationEPSS 0.4%CVE-2019-14822—A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus oEPSS 0.4%CVE-2025-2816HIGHPage View Count 2.8.0 - 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateEPSS 0.4%CVE-2025-60106MEDIUMWordPress EmailKit Plugin <= 1.6.0 - Arbitrary Content Deletion VulnerabilityEPSS 0.4%CVE-2025-49925HIGHWordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-1937HIGHBrizy – Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post ModificationEPSS 0.4%