Weaknesses of type CWE-862

8,735 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-92829MEDIUMBlog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX HandlersEPSS 0.3%CVE-2025-3915MEDIUMAeropage Sync for Airtable <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post DeletionEPSS 0.3%CVE-2024-13801HIGHBWL Advanced FAQ Manager <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options UpdateEPSS 0.3%CVE-2025-0952HIGHEco Nature - Environment & Ecology WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateEPSS 0.3%CVE-2025-4887MEDIUMSourceCodester Online Student Clearance System cross-site request forgeryEPSS 0.3%CVE-2025-12980HIGHPost Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information ExposureEPSS 0.3%CVE-2023-7019MEDIUMLightStart – Maintenance Mode, Coming Soon and Landing Page Builder <= 2.6.8 - Missing AuthorizationEPSS 0.3%CVE-2025-33182HIGHNVIDIA Jetson Linux contains a vulnerability in UEFI, where improper authentication may allow a privileged user to cause corruption of the LEPSS 0.3%CVE-2025-24692HIGHWordPress Bulk Menu Edit plugin <= 1.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-15070MEDIUMData Exposure in Gmission Web FAXEPSS 0.3%CVE-2026-1631MEDIUMFeeds for YouTube < 2.6.4 - Subscriber+ License Data DeletionEPSS 0.3%CVE-2026-24583MEDIUMWordPress SumUp Payment Gateway For WooCommerce plugin <= 2.7.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-81781HIGHWordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-6883MEDIUMEasy Social Feed <= 6.5.2 - Missing Authorization to Settings ModificationEPSS 0.3%CVE-2024-42376MEDIUMMultiple Missing Authorization Check vulnerabilities in SAP Shared Service FrameworkEPSS 0.3%CVE-2023-36694MEDIUMWordPress Kingkong Board plugin <= 2.1.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-67547MEDIUMWordPress Konte theme <= 2.4.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-49081HIGHWordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-39385MEDIUMWordPress Sirat theme <= 1.5.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-9218LOWrtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch FunctionEPSS 0.3%