Weaknesses of type CWE-862

8,723 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-50029MEDIUMWordPress AI Tools <= 4.0.7 - Arbitrary Content Deletion VulnerabilityEPSS 0.3%CVE-2026-1748MEDIUMInvoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information ExposureEPSS 0.3%CVE-2026-84990HIGHntopng: Missing Authorization on System Configuration Backup Download and ListingEPSS 0.3%CVE-2024-49321MEDIUMWordPress Simple Custom Post Order plugin <= 2.5.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-78607MEDIUMMissing Authorization in Elasticsearch Leading to Information DisclosureEPSS 0.3%CVE-2025-3766MEDIUMLogin Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP WhitelistingEPSS 0.3%CVE-2026-62186HIGHOpenClaw < 2026.6.8 Authorization Bypass via HTTP Model OverrideEPSS 0.3%CVE-2025-26764MEDIUMWordPress Distance Based Shipping Calculator plugin <= 2.0.22 - Settings Change vulnerabilityEPSS 0.3%CVE-2025-3843MEDIUMpanhainan DS-Java cross-site request forgeryEPSS 0.3%CVE-2026-66887CRITICALMissing Authorization in Digital Watchdog VMAX DVR and NVR Product LineupsEPSS 0.3%CVE-2023-44988MEDIUMWordPress WP Custom Admin Interface plugin <= 7.32 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-30897MEDIUMWordPress Analytify plugin <= 5.5.1 - Settings Change vulnerabilityEPSS 0.3%CVE-2025-49916HIGHWordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-61596HIGHdjust has broken object-level access control (IDOR)EPSS 0.3%CVE-2026-72669HIGHMissing Authorization in Kibana Leading to Cross-User Information Disclosure and Data TamperingEPSS 0.3%CVE-2024-54323MEDIUMWordPress New User Approve plugin <= 2.6.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-3257MEDIUMxujiangfei admintwo updateSet cross-site request forgeryEPSS 0.3%CVE-2024-11724MEDIUMCookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist ScriptEPSS 0.3%CVE-2026-25387MEDIUMWordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-35174MEDIUMWordPress Flo Forms plugin <= 1.0.42 - Broken Access Control vulnerabilityEPSS 0.3%