Weaknesses of type CWE-862

8,785 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-20302MEDIUMCisco Secure Firewall Management Center Software Authorization Bypass VulnerabilityEPSS 0.3%CVE-2025-50008MEDIUMWordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin <= 1.2.4.5 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-49374HIGHIn JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parametersEPSS 0.3%CVE-2025-5732MEDIUMcode-projects Traffic Offense Reporting System cross-site request forgeryEPSS 0.3%CVE-2025-48133MEDIUMWordPress Uncanny Automator plugin <= 6.4.0.2 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-11926MEDIUMTraveler <= 3.1.6 - Missing Authorization in Several AJAX ActionsEPSS 0.3%CVE-2026-10029MEDIUMEvent Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API EndpointsEPSS 0.3%CVE-2026-12853MEDIUMFlamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-searchEPSS 0.3%CVE-2024-6392MEDIUMImage Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings UpdateEPSS 0.3%CVE-2023-36000MEDIUMITM Server Missing Authorization for Agent ConfigEPSS 0.3%CVE-2025-53452MEDIUMWordPress Event Rocket Plugin <= 3.3 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-5521MEDIUMWuKongOpenSource WukongCRM updataPassword cross-site request forgeryEPSS 0.3%CVE-2025-5132MEDIUMTmall Demo logout cross-site request forgeryEPSS 0.3%CVE-2025-15347HIGHCreator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options UpdateEPSS 0.3%CVE-2023-45765MEDIUMWordPress WP ERP plugin <= 1.12.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-13530MEDIUMCustom Login Page Styler <= 7.1.1 - Missing Authorization to Authenticated (Subsciber+) Log Deletion and Session TerminationEPSS 0.3%CVE-2023-45110MEDIUMWordPress Bold Timeline Lite plugin <= 1.1.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-45002MEDIUMWordPress WP User Frontend plugin <= 3.6.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-47692MEDIUMWordPress Flo Forms plugin <= 1.0.41 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-7721MEDIUMHTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateEPSS 0.3%