Weaknesses of type CWE-862

8,722 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-61952MEDIUMWordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-42051MEDIUMKirby: System API endpoint leaks license data and installed version to authenticated usersEPSS 0.3%CVE-2026-56384MEDIUMCraft CMS - Missing Authorization in assets/preview-thumb EndpointEPSS 0.3%CVE-2026-84901MEDIUMEventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing AuthorizationEPSS 0.3%CVE-2026-81272MEDIUMWordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-4450MEDIUMAliExpress Dropshipping with AliNext Lite <= 3.3.6 - Missing Authorization via Several FunctionsEPSS 0.3%CVE-2025-23957MEDIUMWordPress Sur.ly plugin <= 3.0.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-70618MEDIUMSpacebar Server Missing Authorization via member-ids EndpointEPSS 0.3%CVE-2025-47887MEDIUMMissing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permiEPSS 0.3%CVE-2026-87919MEDIUMProduct XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via ShortcodeEPSS 0.3%CVE-2024-33000LOWMissing Authorization check in SAP Bank Account ManagementEPSS 0.3%CVE-2025-65029HIGHRallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll ParticipantsEPSS 0.3%CVE-2024-13449MEDIUMBoom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings UpdateEPSS 0.3%CVE-2026-2601MEDIUMMissing Authorization in GitLabEPSS 0.3%CVE-2025-14629MEDIUMAlchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File DeletionEPSS 0.3%CVE-2026-27346MEDIUMWordPress B2BKing plugin < 5.2.10 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-7858MEDIUMMedia Library Folders <= 8.2.3 - Missing Authorization on Various FunctionsEPSS 0.3%CVE-2026-0927MEDIUMKiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File UploadEPSS 0.3%CVE-2025-5956MEDIUMWP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee FunctionEPSS 0.3%CVE-2026-22459MEDIUMWordPress WordPress CTA plugin <= 2.1.2 - Broken Access Control vulnerabilityEPSS 0.3%