Weaknesses of type CWE-862

8,788 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-58009LOWWordPress CP Multi View Event Calendar plugin <= 1.4.35 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-68753MEDIUMAnonymous users may access restricted Artifactory content under specific configurationsEPSS 0.3%CVE-2026-43789MEDIUMAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS TEPSS 0.3%CVE-2024-13374MEDIUMWP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name DisclosureEPSS 0.3%CVE-2025-30959MEDIUMWordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-62037MEDIUMWordPress Togo theme < 1.0.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-7879MEDIUMConcrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password()EPSS 0.3%CVE-2025-22318HIGHWordPress Standard Box Sizes plugin <= 1.6.13 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-10543MEDIUMTumult Hype Animations <= 1.9.14 - Missing AuthorizationEPSS 0.3%CVE-2026-11876MEDIUMMissing Authorization in get_deployed_stack Endpoint in zenml-io/zenmlEPSS 0.3%CVE-2025-26948MEDIUMWordPress Pie Register Premium plugin <= 3.8.3.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-1926MEDIUMSubscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription CancellationEPSS 0.3%CVE-2024-23524MEDIUMWordPress PilotPress plugin <= 2.0.30 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-41382LOWOpenClaw < 2026.3.31 - Discord Voice Ingress Authorization Bypass via Channel and Role Validation GapsEPSS 0.3%CVE-2026-41298MEDIUMOpenClaw < 2026.4.2 - Authorization Bypass in Session Termination EndpointEPSS 0.3%CVE-2025-48247MEDIUMWordPress Shortlinks by Pretty Links plugin <= 3.6.15 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-55073HIGHA Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their EPSS 0.3%CVE-2025-9954HIGHAcquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105EPSS 0.3%CVE-2026-25609MEDIUMprofile command may permit unauthorized configurationEPSS 0.3%CVE-2026-24369HIGHWordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerabilityEPSS 0.3%