Weaknesses of type CWE-862

8,495 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-2086CRITICALIntegrate Google Drive <= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and ExportEPSS 0.7%CVE-2026-26083CRITICALA missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0EPSS 0.7%CVE-2022-46838CRITICALWordPress JS Help Desk plugin <= 2.7.1 - Unauthenticated Settings Change VulnerabilityEPSS 0.7%CVE-2021-4345MEDIUMuListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/DeletionEPSS 0.7%CVE-2021-4388MEDIUMOpal Estate <= 1.6.11 - Missing AuthorizationEPSS 0.7%CVE-2022-43685HIGHCKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user EPSS 0.7%CVE-2023-22737MEDIUMwire-server vulnerable to unauthorized removal of Bots from ConversationsEPSS 0.7%CVE-2025-13528MEDIUMFeedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' ParameterEPSS 0.7%CVE-2026-4119CRITICALCreate DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.phpEPSS 0.7%CVE-2024-45461MEDIUMApache CloudStack Quota plugin: Access checks not enforced in QuotaEPSS 0.7%CVE-2024-11205HIGHWPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription CancellationEPSS 0.7%CVE-2024-7475CRITICALImproper Access Control in lunary-ai/lunaryEPSS 0.7%CVE-2024-1170HIGHPost Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media DeletionEPSS 0.7%CVE-2026-7761HIGHUltimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link DisclosureEPSS 0.7%CVE-2023-24448MEDIUMA missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to aEPSS 0.7%CVE-2023-24453MEDIUMA missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attackeEPSS 0.7%CVE-2025-3604CRITICALFlynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account TakeoverEPSS 0.7%CVE-2021-24842—Bulk Datetime Change < 1.12 - Missing AuthorisationEPSS 0.7%CVE-2024-4317LOWPostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checksEPSS 0.7%CVE-2022-48367CRITICALAn issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.EPSS 0.7%