Weaknesses of type CWE-862

8,690 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-3071MEDIUMACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content UpdateEPSS 0.4%CVE-2025-24751MEDIUMWordPress CoBlocks plugin <= 3.1.13 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-84661MEDIUMA missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `EPSS 0.4%CVE-2026-84660MEDIUMA missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by theEPSS 0.4%CVE-2025-31546MEDIUMWordPress Swiss Toolkit For WP plugin <= 1.4.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-31099MEDIUMWordPress Phlox Core Elements plugin <= 2.15.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-1861MEDIUMDisable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table TruncationEPSS 0.4%CVE-2024-32692HIGHWordPress Chauffeur Taxi Booking System for WordPress plugin <= 6.9 - Broken Authentication vulnerabilityEPSS 0.4%CVE-2024-9025MEDIUMSight – Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_titleEPSS 0.4%CVE-2026-75813HIGHEbyte NE2-D11 Missing AuthorizationEPSS 0.4%CVE-2026-55548MEDIUMYamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packetsEPSS 0.4%CVE-2024-48045MEDIUMWordPress Happy Elementor Addons plugin <= 3.12.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-8548HIGHKB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator ActionsEPSS 0.4%CVE-2024-32832CRITICALWordPress Login with Phone Number plugin <= 1.6.93 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-14757MEDIUMCost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status BypassEPSS 0.4%CVE-2026-35630HIGHOpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval ButtonsEPSS 0.4%CVE-2024-33920MEDIUMWordPress Democracy Poll plugin <= 6.0.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-2508MEDIUMWP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta ModificationEPSS 0.4%CVE-2024-44006MEDIUMWordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-90537HIGHWWBN AVideo Scheduler sendEmail Missing Authorization via TokenEPSS 0.4%