Weaknesses of type CWE-862

8,721 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-32122MEDIUMOpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2)EPSS 0.3%CVE-2025-31896MEDIUMWordPress GetBookingsWP Plugin <= 1.1.27 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-49065HIGHWordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-30974MEDIUMWordPress Post Grid Master plugin <= 3.4.17 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-37427MEDIUMWordPress Timetics plugin <= 1.0.21 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-47411MEDIUMpraisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}EPSS 0.3%CVE-2026-8377HIGHImproper Authorization in Armiya Technologies' Access Control SystemEPSS 0.3%CVE-2025-14971MEDIUMLink Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/CancellationEPSS 0.3%CVE-2024-22296MEDIUMWordPress 12 Step Meeting List plugin <= 3.14.28 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-90533MEDIUMFlowise before 3.1.4 Broken Access Control via organizationuserEPSS 0.3%CVE-2026-22479HIGHWordPress Easy Post Submission plugin <= 2.4.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-38744HIGHWordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control to Unauth Stored XSS vulnerabilityEPSS 0.3%CVE-2025-68021MEDIUMWordPress ConveyThis plugin <= 269.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2021-4444HIGHProduct Filter by WooBeWoo <= 1.4.9 - Missing AuthorizationEPSS 0.3%CVE-2026-1000MEDIUMMailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data DeletionEPSS 0.3%CVE-2026-40726HIGHWordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-12027MEDIUMMessage Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/DeletionsEPSS 0.3%CVE-2025-68023MEDIUMWordPress Addonify – Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerabilityEPSS 0.3%CVE-2026-39432HIGHWordPress Timetics plugin <= 1.0.53 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-13639MEDIUMRead More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post DeletionEPSS 0.3%