Weaknesses of type CWE-862

8,721 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-2608MEDIUMGutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing AuthorizationEPSS 0.3%CVE-2026-47127MEDIUMGhostfolio has a Stripe subscription bypassEPSS 0.3%CVE-2026-31942HIGHLibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keysEPSS 0.3%CVE-2025-68022HIGHWordPress Plugin BlueX for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-14657HIGHEventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'EPSS 0.3%CVE-2026-57367HIGHWordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-76336HIGHImproper Access Control through the REST API in Splunk EnterpriseEPSS 0.3%CVE-2026-82242HIGHBudibase before 3.41.3 Cross-Application Resource Injection via Missing AuthorizationEPSS 0.3%CVE-2023-33922MEDIUMWordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-81035HIGHMidday Missing Owner Check on Team DeletionEPSS 0.3%CVE-2026-1897MEDIUMWeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorizationEPSS 0.3%CVE-2026-28190HIGHWordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-74926HIGHMultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST EndpointEPSS 0.3%CVE-2025-26955MEDIUMWordPress Industrial Lite theme <= 1.0.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-84653LOWJenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in tEPSS 0.3%CVE-2026-27484LOWOpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flowsEPSS 0.3%CVE-2026-57332HIGHWordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-45295MEDIUMFreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking EndpointEPSS 0.3%CVE-2025-3561MEDIUMghostxbh uzy-ssm-mall cross-site request forgeryEPSS 0.3%CVE-2025-49651HIGHMissing Authorization for Interactive SessionsEPSS 0.3%