Weaknesses of type CWE-862

8,720 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-7030MEDIUMSmart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data UpdateEPSS 0.4%CVE-2026-75051HIGHIn JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possibleEPSS 0.4%CVE-2024-24883MEDIUMWordPress Prime Slider plugin <= 3.11.10 - Broken Access Control on Duplicate Post vulnerabilityEPSS 0.4%CVE-2025-43008MEDIUMMissing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM PortugalEPSS 0.4%CVE-2026-1944MEDIUMCallbackKiller service widget <= 1.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings UpdateEPSS 0.4%CVE-2023-46073MEDIUMWordPress DX Delete Attached Media plugin <= 2.0.5.1 - Broken Access Control vulnerability + CSRFEPSS 0.4%CVE-2026-11340HIGHAuthorization Bypass in HAVELSAN's Open Source Project Liman MYSEPSS 0.4%CVE-2025-0526LOWIn affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field EPSS 0.4%CVE-2024-37929MEDIUMWordPress User Activity Log Pro plugin <= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-30512LOWWordPress weForms plugin <= 1.6.20 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-86479HIGHIn JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resourcEPSS 0.4%CVE-2023-45658HIGHWordPress Nexter theme <= 2.0.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-56236MEDIUMWordPress Hestia Nginx Cache plugin <= 2.4.0 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.4%CVE-2026-84779HIGHWordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-47187MEDIUMWordPress Animated Rotating Words plugin <= 5.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-76394HIGHMissing Authorization in Container and Connection Management through the REST API in Splunk AI ToolkitEPSS 0.4%CVE-2023-47515MEDIUMWordPress Seers | GDPR & CCPA Cookie Consent & Compliance plugin <= 8.1.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-46633MEDIUMWordPress WP Glossary plugin <= 3.1.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-45766MEDIUMWordPress Poll Maker plugin <= 4.7.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-55483MEDIUMSnipe-IT: Privilege Escalation via Missing admin Permission Check in User CreationEPSS 0.4%