Weaknesses of type CWE-862

8,784 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-27366HIGHWordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-2506MEDIUMWhen pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access tEPSS 0.3%CVE-2024-13554MEDIUMThe Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order ManipulationEPSS 0.3%CVE-2024-24739MEDIUMMissing authorization check in SAP BAM (Bank Account Management)EPSS 0.3%CVE-2025-6718HIGHB1.lt for WooCommerce <= 2.2.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL InjectionEPSS 0.3%CVE-2025-14720MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX ActionsEPSS 0.3%CVE-2026-47742MEDIUMShopper: Missing authorization on Product admin Livewire sub-form componentsEPSS 0.3%CVE-2025-11378MEDIUMShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/ExportEPSS 0.3%CVE-2025-32296MEDIUMWordPress Simple Link Directory Pro plugin < 14.8.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2023-3352MEDIUMSmush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List DeletionEPSS 0.3%CVE-2026-1667HIGHSEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()EPSS 0.3%CVE-2025-8425HIGHMy WP Translate <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.3%CVE-2026-72675HIGHMissing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data ModificationEPSS 0.3%CVE-2025-31071MEDIUMWordPress HotStar – Multi-Purpose Business Theme <= 1.4 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-56006MEDIUMWordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-48272MEDIUMWordPress WP Job Portal plugin <= 2.3.2 - Insecure Direct Object References (IDOR) VulnerabilityEPSS 0.3%CVE-2025-5957MEDIUMGuest Support – Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket DeletionEPSS 0.3%CVE-2026-47233MEDIUMAdmidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024EPSS 0.3%CVE-2025-49910HIGHWordPress WPGuppy plugin <= 1.1.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-68754MEDIUMPublishers without delete permission can overwrite docker layer informationEPSS 0.3%