Weaknesses of type CWE-862

8,720 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-57944MEDIUMWordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-27021MEDIUMDiscourse: Poll voters endpoint lacked post visibility checksEPSS 0.3%CVE-2026-44555HIGHOpen WebUI: Base Model Routing Bypasses Access Control via Model ChainingEPSS 0.3%CVE-2026-47226MEDIUMAdmidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privilegesEPSS 0.3%CVE-2024-1539MEDIUMMissing Authorization in GitLabEPSS 0.3%CVE-2023-34003MEDIUMWordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerabilityEPSS 0.3%CVE-2025-47556MEDIUMWordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-35598MEDIUMVikunja has Missing Authorization on CalDAV Task ReadEPSS 0.3%CVE-2025-30958MEDIUMWordPress onOffice for WP-Websites plugin <= 6.5.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-23477HIGHRocket.Chat Unauthorized Access to OAuth App DetailsEPSS 0.3%CVE-2026-52866HIGHApollo Pharmacy Blood Glucose Monitoring System APG-01 BT Missing AuthorizationEPSS 0.3%CVE-2025-26901MEDIUMWordPress Brizy Pro plugin <= 2.6.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-37394MEDIUMWordPress WP Dummy Content Generator plugin <= 2.3.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-13746MEDIUMBooking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts FunctionsEPSS 0.3%CVE-2026-0572MEDIUMWebPurify Profanity Filter <= 4.0.2 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_optionsEPSS 0.3%CVE-2026-0656HIGHiPaymu Payment Gateway for WooCommerce <= 2.0.2 - Missing Authentication to Unauthenticated Payment Bypass and Order Information DisclosureEPSS 0.3%CVE-2025-39447HIGHWordPress JetElements For Elementor plugin <= 2.7.4.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-39477CRITICALWordPress InWave Jobs Plugin <= 3.5.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-31415HIGHWordPress YayExtra <= 1.5.2 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-39451HIGHWordPress JetBlocks For Elementor plugin <= 1.3.16 - Broken Access Control VulnerabilityEPSS 0.3%