Weaknesses of type CWE-862

8,757 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-5483HIGHLC Wizard 1.2.10 - 1.3.0 - Missing Authorization to Unauthenticated Privilege EscalationEPSS 0.3%CVE-2026-74010MEDIUMWordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-28962MEDIUMWordPress Advanced Google Universal Analytics plugin <= 1.0.3 - Broken Access Control to Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-42983HIGHMissing Authorization check in SAP Business Warehouse and SAP Plug-In BasisEPSS 0.3%CVE-2025-32045MEDIUMMoodle: hidden grades shown to users without permission on some grade reportsEPSS 0.3%CVE-2024-38506MEDIUMIn JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflowsEPSS 0.3%CVE-2025-22385MEDIUMAn issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does notEPSS 0.3%CVE-2026-96515HIGHCommand Injection Vulnerability in Netlink ICT HG323RW RouterEPSS 0.3%CVE-2026-71307HIGHLemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations APIEPSS 0.3%CVE-2025-66530MEDIUMWordPress Webba Booking plugin <= 6.2.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-64684MEDIUMIn JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback formEPSS 0.3%CVE-2024-31359MEDIUMWordPress Premmerce Product Filter for WooCommerce plugin <= 3.7.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-23963MEDIUMWordPress Mark Posts plugin <= 2.2.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-6688MEDIUMOxygen Builder <= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet UpdateEPSS 0.3%CVE-2023-51516MEDIUMWordPress Business Directory Plugin – Easy Listing Directories for WordPress plugin <= 6.3.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-55544HIGHNextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and TamperingEPSS 0.3%CVE-2024-24716MEDIUMWordPress Awesome Support plugin <= 6.1.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-43326MEDIUMWordPress Plugin Notes Plus plugin <= 1.2.7 - Arbitrary Content Deletion vulnerabilityEPSS 0.3%CVE-2026-94218LOWKeycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpointEPSS 0.3%CVE-2026-27946HIGHZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser APIEPSS 0.3%