Weaknesses of type CWE-862

8,762 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-96515HIGHCommand Injection Vulnerability in Netlink ICT HG323RW RouterEPSS 0.3%CVE-2024-31359MEDIUMWordPress Premmerce Product Filter for WooCommerce plugin <= 3.7.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-30926MEDIUMWordPress King Addons for Elementor plugin <= 24.12.58 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-94218LOWKeycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpointEPSS 0.3%CVE-2026-78258MEDIUMWordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-66676MEDIUMWordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-62137MEDIUMWordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2026-74017MEDIUMWordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-39543MEDIUMWordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-23440MEDIUMWordPress radSLIDE plugin <= 2.1 - Broken Access Control to Stored Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2026-84835MEDIUMWordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-73353MEDIUMWordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-54745MEDIUMWordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-53221MEDIUMWordPress CodeablePress plugin <= 1.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-32727MEDIUMWordPress RomethemeForm For Elementor plugin <= 1.1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-28494MEDIUMWordPress Contact Form Email plugin <= 1.3.31 - Missing Authorization Leading To Feedback Submission VulnerabilityEPSS 0.3%CVE-2026-65486MEDIUMWordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-26523MEDIUMWordPress Calculated Fields Form plugin <= 1.1.120 - Missing Authorization Leading To Feedback Submission VulnerabilityEPSS 0.3%CVE-2023-51496MEDIUMWordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-85304MEDIUMWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Broken Access Control vulnerabilityEPSS 0.3%