Weaknesses of type CWE-862

8,756 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-26657MEDIUMInformation Disclosure vulnerability in SAP KMC WPCEPSS 0.3%CVE-2026-76348LOWMissing Authorization in Search Head Cluster Member Controls in Splunk EnterpriseEPSS 0.3%CVE-2026-40722MEDIUMWordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-43316HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26, visionOS 26. A malicious app may be aEPSS 0.3%CVE-2025-28965HIGHWordPress URL Shortener <= 3.0.7 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-47634MEDIUMWordPress WC Pickup Store plugin <= 1.8.9 - Settings Change VulnerabilityEPSS 0.3%CVE-2024-6590MEDIUMSpreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Settings UpdateEPSS 0.3%CVE-2023-7287MEDIUMPaytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'pt_cancel_subscription'EPSS 0.3%CVE-2026-103268HIGHGhost 1.0.0 before 6.62.0 Suspension Bypass via Password ResetEPSS 0.3%CVE-2026-71308HIGHLemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificatesEPSS 0.3%CVE-2026-97360CRITICALHFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template EngineEPSS 0.3%CVE-2023-46195MEDIUMWordPress Headline Analyzer plugin <= 1.3.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-87606HIGHMissing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer prEPSS 0.3%CVE-2024-49694MEDIUMWordPress My Wp Brand – Hide menu & Hide Plugin plugin <= 1.1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-5857MEDIUMInteractive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media DeletionEPSS 0.3%CVE-2025-12849MEDIUMContest Gallery <= 28.0.2 - Missing AuthorizationEPSS 0.3%CVE-2026-45703MEDIUMPimcore: WordExport Authorization Bypass for Unauthorized Document ExportEPSS 0.3%CVE-2026-2371MEDIUMGreenshift <= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load'EPSS 0.3%CVE-2023-40209MEDIUMWordPress Highcompress Image Compressor plugin <= 6.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-43260MEDIUMWordPress Clearfy Cache plugin <= 2.2.4 - Broken Access Control vulnerabilityEPSS 0.3%