Weaknesses of type CWE-862

8,732 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-9686MEDIUMOrder Notification for Telegram <= 1.0.1 - Missing Authorization to Unauthenticated Send Telegram Test MessageEPSS 0.3%CVE-2025-49509MEDIUMWordPress Audio Editor & Recorder plugin <= 2.2.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-50428MEDIUMWordPress Multi Step Form plugin <= 1.7.21 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-23849MEDIUMWordPress PAPERCITE plugin <= 0.5.18 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-69332MEDIUMWordPress Bookify plugin <= 1.1.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-72805MEDIUMSiYuan before v3.7.4 Information Disclosure via Block EndpointsEPSS 0.3%CVE-2026-8614MEDIUMAssistio <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_assistio_settings AJAX ActionEPSS 0.3%CVE-2026-25317HIGHWordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-72799MEDIUMSiYuan before v3.7.4 Information Disclosure via Path ResolutionEPSS 0.3%CVE-2026-73048MEDIUMSiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationIDEPSS 0.3%CVE-2026-81269MEDIUMData field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108EPSS 0.3%CVE-2026-42174MEDIUMKirby: User avatar creation, replacement and deletion are not gated by user update permissionsEPSS 0.3%CVE-2026-72803MEDIUMSiYuan before v3.7.4 Information Disclosure via getBlockAttrsEPSS 0.3%CVE-2026-8239MEDIUMConcrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'EPSS 0.3%CVE-2026-72800MEDIUMSiYuan before v3.7.4 Information Disclosure via Unfiltered APIEPSS 0.3%CVE-2024-23503MEDIUMWordPress Ninja Tables plugin <= 5.0.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-43638MEDIUMBitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher ImportEPSS 0.3%CVE-2024-13698MEDIUMJobify - Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image GenerationEPSS 0.3%CVE-2026-54012HIGHOpen WebUI: Forged model meta.knowledge allows cross-user file read and deletionEPSS 0.3%CVE-2026-93341MEDIUMMarketKing < 2.1.72 Missing Authorization via marketking_send_refund AJAXEPSS 0.3%