Weaknesses of type CWE-862

8,692 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-72796MEDIUMSiYuan before v3.7.4 Access Control Bypass via Static RoutesEPSS 0.4%CVE-2026-23806HIGHWordPress Jobs for WordPress plugin <= 2.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-12266MEDIUMELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing AuthorizationEPSS 0.4%CVE-2023-2786MEDIUMChannel commands execution doesn't properly verify permissionsEPSS 0.4%CVE-2026-3581MEDIUMBasic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate UpdateEPSS 0.4%CVE-2024-49698MEDIUMWordPress Great Restaurant Menu WP plugin <= 1.4.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-13039MEDIUMEventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST APIEPSS 0.4%CVE-2026-12557MEDIUMNinja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST EndpointsEPSS 0.4%CVE-2023-38514MEDIUMWordPress Social Share Icons & Social Share Buttons plugin <= 3.5.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-52541HIGHAuthentication vulnerability in the API for app pre-loading. Impact: Successful exploitation of this vulnerability may affect service confidEPSS 0.4%CVE-2025-15330HIGHTanium addressed an improper input validation vulnerability in Deploy.EPSS 0.4%CVE-2024-10326MEDIUMRomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgetsEPSS 0.4%CVE-2025-11439MEDIUMJhumanJ OpnForm integrations authorizationEPSS 0.4%CVE-2026-54356HIGHBudibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`EPSS 0.4%CVE-2026-4162HIGHGravity SMTP <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Plugin UninstallEPSS 0.4%CVE-2024-52549MEDIUMJenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perEPSS 0.4%CVE-2026-45085MEDIUMDiscourse: Chat misauthorization and information disclosureEPSS 0.4%CVE-2026-44751HIGHMissing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP PlatformEPSS 0.4%CVE-2026-84794HIGHCraft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-assetEPSS 0.4%CVE-2026-91929HIGHFlowise before 3.1.4 Cross-Tenant Authorization BypassEPSS 0.4%