Weaknesses of type CWE-862

8,493 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-45828MEDIUMWordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerabilityEPSS 0.8%CVE-2018-25105CRITICALFile Manager <= 3.0 - Unauthenticated Arbitrary File Upload/DownloadEPSS 0.8%CVE-2024-3213MEDIUMRelevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option UpdateEPSS 0.8%CVE-2024-5637HIGHMarket Exporter <= 2.0.19 - Missing Authorization to Arbitrary File DeletionEPSS 0.8%CVE-2023-27963HIGHThe issue was addressed with additional permissions checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 EPSS 0.8%CVE-2022-38651CRITICALA security filter misconfiguration exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to byEPSS 0.8%CVE-2023-6394HIGHQuarkus: graphql operations over websockets bypassEPSS 0.8%CVE-2022-41254MEDIUMMissing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to connect to an attackerEPSS 0.8%CVE-2021-4355HIGHWelcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information DisclosureEPSS 0.8%CVE-2023-37860HIGHPHOENIX CONTACT: Missing Authorization in WP 6xxx Web panelsEPSS 0.8%CVE-2022-31167HIGHXWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same referenceEPSS 0.8%CVE-2023-3713HIGHProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option UpdateEPSS 0.8%CVE-2022-0745—Like Button Rating < 2.6.45 - Arbitrary e-mail SendingEPSS 0.8%CVE-2021-44233—SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated userEPSS 0.8%CVE-2026-34048CRITICALCoolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team serversEPSS 0.8%CVE-2023-41875MEDIUMWordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerabilityEPSS 0.8%CVE-2024-29228HIGHMissing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allEPSS 0.8%CVE-2021-4369MEDIUMFrontend File Manager <= 18.2 - Unauthenticated Content InjectionEPSS 0.8%CVE-2024-29229HIGHMissing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 aEPSS 0.8%CVE-2025-11669HIGHBroken Access ControlEPSS 0.8%