Weaknesses of type CWE-862

8,690 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-27092MEDIUMWordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-14609MEDIUMWise Analytics <= 1.1.9 - Missing Authorization to Unauthenticated Arbitrary Analytics Database Disclosure via 'name' ParameterEPSS 0.4%CVE-2026-86332MEDIUMOdh-dashboard: odh-dashboard: nim credential secret readable by any authenticated userEPSS 0.4%CVE-2026-1832MEDIUMThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache DeletionEPSS 0.4%CVE-2026-92458MEDIUMyshop-crm through 2.1.3 Missing Authorization via StoreProductController onSaleEPSS 0.4%CVE-2026-7249MEDIUMLocation Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache PurgingEPSS 0.4%CVE-2026-9184MEDIUM24liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX actionEPSS 0.4%CVE-2026-65381HIGHA validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. ThEPSS 0.4%CVE-2026-34261MEDIUMMissing Authorization check in SAP Business Analytics and SAP Content ManagementEPSS 0.4%CVE-2026-12729MEDIUMweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX ActionEPSS 0.4%CVE-2019-25214HIGHShopWP <= 2.0.4 - Missing Authorization to Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-10363MEDIUMImproper Access Control in danny-avila/LibreChatEPSS 0.4%CVE-2026-47755MEDIUMITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential ModalEPSS 0.4%CVE-2026-72906MEDIUMERPNext: Unauthorised triggering of automated emails due to missing validationEPSS 0.4%CVE-2020-7343MEDIUMImproper Authorization vulnerability in MAEPSS 0.4%CVE-2026-7105MEDIUMXpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() FunctionEPSS 0.4%CVE-2024-10853MEDIUMBuy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order DeletionEPSS 0.4%CVE-2026-3426MEDIUMRTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration ModificationEPSS 0.4%CVE-2020-36833MEDIUMIndeed Membership Pro 7.3 - 8.6 - Missing Authorization ChecksEPSS 0.4%CVE-2026-34233MEDIUMCtrlPanel has Missing Authentication Checks in Datatable Admin EndpointsEPSS 0.4%