Weaknesses of type CWE-862

8,495 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-8001MEDIUMVIWIS LMS Print authorizationEPSS 0.8%CVE-2025-22609CRITICALCoolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)EPSS 0.8%CVE-2022-36068HIGHDiscourse moderators can edit themes via the APIEPSS 0.8%CVE-2021-41112HIGHMissing Authorization in RundeckEPSS 0.7%CVE-2025-21416HIGHAzure Virtual Desktop Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2023-34463HIGHUnauthorized users can delete applications in DataEaseEPSS 0.7%CVE-2023-49980HIGHA directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files witEPSS 0.7%CVE-2023-33948MEDIUMThe Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can EPSS 0.7%CVE-2022-45410MEDIUMWhen a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownEPSS 0.7%CVE-2022-35293CRITICALDue to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploiEPSS 0.7%CVE-2024-6760HIGHktrace(2) fails to detach when executing a setuid binaryEPSS 0.7%CVE-2021-42848MEDIUMAn information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user EPSS 0.7%CVE-2023-4374MEDIUMWP Remote Users Sync <= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log ViewEPSS 0.7%CVE-2026-27181HIGHMajorDoMo Unauthenticated Module Uninstall via Market EndpointEPSS 0.7%CVE-2020-36712HIGHKali Forms <= 2.1.1 - Unauthenticated Arbitrary Post DeletionEPSS 0.7%CVE-2023-37967MEDIUMWordPress DirectoryPress plugin <= 3.6.2 - Unauthenticated Broken Access Control VulnerabilityEPSS 0.7%CVE-2023-3125MEDIUMB2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price ModificationEPSS 0.7%CVE-2024-2086CRITICALIntegrate Google Drive <= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and ExportEPSS 0.7%CVE-2026-26083CRITICALA missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0EPSS 0.7%CVE-2022-41929MEDIUMMissing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcoreEPSS 0.7%