Weaknesses of type CWE-862

8,788 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-9954HIGHAcquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105EPSS 0.3%CVE-2025-39352HIGHWordPress Grand Restaurant WordPress theme <= 7.0 - Arbitrary Options Deletion vulnerabilityEPSS 0.3%CVE-2026-25609MEDIUMprofile command may permit unauthorized configurationEPSS 0.3%CVE-2026-24369HIGHWordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-11191MEDIUMRealPress < 1.1.0 - Unauthenticated Content Creation/Email Sending via RESTEPSS 0.3%CVE-2026-65922HIGHPotential unauthorized modification of Artifactory internal metadataEPSS 0.3%CVE-2025-53499CRITICALUnauthorized Inspection of Protected Variables in AbuseFilterEPSS 0.3%CVE-2025-26928MEDIUMWordPress Order Limit for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-11876MEDIUMMissing Authorization in get_deployed_stack Endpoint in zenml-io/zenmlEPSS 0.3%CVE-2025-48247MEDIUMWordPress Shortlinks by Pretty Links plugin <= 3.6.15 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-41298MEDIUMOpenClaw < 2026.4.2 - Authorization Bypass in Session Termination EndpointEPSS 0.3%CVE-2025-53495CRITICALUnauthorized Disclosure of IP Reputation in AbuseFilterEPSS 0.3%CVE-2026-87443MEDIUMMissing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a craftEPSS 0.3%CVE-2025-31406MEDIUMWordPress ELEX WooCommerce Request a Quote plugin <= 2.3.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-27792MEDIUMSeerr missing authentication on pushSubscription endpointsEPSS 0.3%CVE-2025-3437MEDIUMMotors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-upEPSS 0.3%CVE-2026-87631MEDIUMMissing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information viaEPSS 0.3%CVE-2025-4046HIGHMissing Authorization in Lexmark Cloud Services badge managementEPSS 0.3%CVE-2024-12244MEDIUMMissing Authorization in GitLabEPSS 0.3%CVE-2024-1217HIGHContact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin DeactivationEPSS 0.3%