Weaknesses of type CWE-862

8,721 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-32122MEDIUMOpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2)EPSS 0.3%CVE-2026-49065HIGHWordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-1000MEDIUMMailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data DeletionEPSS 0.3%CVE-2026-8377HIGHImproper Authorization in Armiya Technologies' Access Control SystemEPSS 0.3%CVE-2026-67218LOWRabbitMQ: Super-stream HTTP creation skips configure-permission checkEPSS 0.3%CVE-2025-31896MEDIUMWordPress GetBookingsWP Plugin <= 1.1.27 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-14971MEDIUMLink Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/CancellationEPSS 0.3%CVE-2025-69181HIGHWordPress Lawyer Directory plugin <= 1.3.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-37427MEDIUMWordPress Timetics plugin <= 1.0.21 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2021-4444HIGHProduct Filter by WooBeWoo <= 1.4.9 - Missing AuthorizationEPSS 0.3%CVE-2024-13639MEDIUMRead More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post DeletionEPSS 0.3%CVE-2025-46489MEDIUMWordPress Bulk Assign Linked Products For WooCommerce plugin <= 2.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-47486MEDIUMWordPress Gutenberg & Elementor Templates Importer For Responsive plugin <= 3.1.9 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-46485MEDIUMWordPress WP Customize Login Page plugin <= 1.6.5 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2023-4104MEDIUMAn invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitraEPSS 0.3%CVE-2026-20888MEDIUMGitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)EPSS 0.3%CVE-2025-47480MEDIUMWordPress Graphina plugin <= 3.0.4 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-4958HIGHUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege EscalationEPSS 0.3%CVE-2025-62151MEDIUMWordPress Virtuaria PagBank / PagSeguro para Woocommerce plugin <= 3.6.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-31739MEDIUMWordPress Minimalistic Event Manager plugin <= 1.1.1 - Broken Access Control vulnerabilityEPSS 0.3%