Weaknesses of type CWE-862

8,486 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-51650HIGHUnauthorized access vulnerability on three interfacesEPSS 0.9%CVE-2026-48751CRITICALIncus has a restricted project bypass leading to arbitrary command executionEPSS 0.9%CVE-2025-64401HIGHApache OpenOffice: Remote documents loaded without prompt via IFrameEPSS 0.9%CVE-2025-24249CRITICALA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOEPSS 0.9%CVE-2025-33185MEDIUMNVIDIA AIStore contains a vulnerability in AuthN where an unauthenticated user may cause information disclosure.  A successful exploit of thEPSS 0.9%CVE-2020-10701—A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-onEPSS 0.9%CVE-2024-9756MEDIUMOrder Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File UploadEPSS 0.9%CVE-2024-13994HIGHNagios XI < 2024R1.1.2 Allow Insecure Logins Missing AuthorizationEPSS 0.9%CVE-2021-21255MEDIUMentities switch IDOREPSS 0.9%CVE-2025-12975HIGHCTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin InstallationEPSS 0.9%CVE-2024-8480HIGHImage Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File UploadEPSS 0.9%CVE-2020-36697HIGHWP GDPR <= 2.1.1 - Missing Authorization ChecksEPSS 0.9%CVE-2019-25217CRITICALSiteGround Optimizer <= 5.0.12 - Missing AuthorizationEPSS 0.9%CVE-2026-69641CRITICALMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-92466HIGHmicroservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission CheckingEPSS 0.8%CVE-2022-0905MEDIUMMissing Authorization in go-gitea/giteaEPSS 0.8%CVE-2023-41870MEDIUMWordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerabilityEPSS 0.8%CVE-2023-25988HIGHWordPress Video Gallery – YouTube Gallery plugin <= 1.7.6 - Broken Access Control vulnerabilityEPSS 0.8%CVE-2022-41930HIGHorg.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable usersEPSS 0.8%CVE-2020-14491—OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege EPSS 0.8%