Weaknesses of type CWE-862

8,720 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-55483MEDIUMSnipe-IT: Privilege Escalation via Missing admin Permission Check in User CreationEPSS 0.4%CVE-2023-46637MEDIUMWordPress Generate Dummy Posts plugin <= 1.0.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-84779HIGHWordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-57949MEDIUMWordPress Ongkoskirim.id Plugin <= 1.0.6 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2026-76394HIGHMissing Authorization in Container and Connection Management through the REST API in Splunk AI ToolkitEPSS 0.4%CVE-2023-45045MEDIUMWordPress WP Custom Widget area plugin <= 1.2.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-5805MEDIUMWordPress Electron theme <= 1.8.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-46633MEDIUMWordPress WP Glossary plugin <= 3.1.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-54842HIGHWordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-1944MEDIUMCallbackKiller service widget <= 1.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings UpdateEPSS 0.4%CVE-2023-45658HIGHWordPress Nexter theme <= 2.0.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-4129HIGHImproper Access Controls in NI SystemLinkEPSS 0.4%CVE-2026-59796HIGHIn JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checksEPSS 0.4%CVE-2026-75051HIGHIn JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possibleEPSS 0.4%CVE-2024-10866MEDIUMExport Import Menus <= 1.9.1 - Missing Authorization to Unauthenticated Menu ExportEPSS 0.4%CVE-2025-68911MEDIUMWordPress Solace theme <= 2.1.16 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-69403MEDIUMWindows SMB Server Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-46635MEDIUMWordPress YITH WooCommerce Product Add-Ons plugin <= 4.2.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-54418HIGHLeantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and BypassEPSS 0.4%CVE-2024-7030MEDIUMSmart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data UpdateEPSS 0.4%