Weaknesses of type CWE-862

10,142 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-32724HIGHWordPress SharkDropship and Affiliate for AliExpress, eBay, Amazon, Etsy plugin <= 2.1.1 - Arbitrary Content Deletion vulnerabilityEPSS 0.8%CVE-2021-40501—SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business usEPSS 0.8%CVE-2026-59113HIGHVisual Studio Code Remote Code Execution VulnerabilityEPSS 0.8%CVE-2021-35001LOWBMC Track-It! GetData Missing Authorization Information Disclosure VulnerabilityEPSS 0.8%CVE-2024-29241CRITICALMissing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remEPSS 0.8%CVE-2024-4875MEDIUMHT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options UpdateEPSS 0.8%CVE-2026-57139CRITICALPraisonAI MCPServer exposes unauthenticated HTTP tools/callEPSS 0.8%CVE-2023-30486MEDIUMWordPress Square theme <= 2.0.0 - Broken Access ControlEPSS 0.8%CVE-2013-10072HIGHNagios XI < 2012R1.6 Auto-Discovery Missing AuthorizationEPSS 0.8%CVE-2026-25903HIGHApache NiFi: Missing Authorization of Restricted Permissions for Component UpdatesEPSS 0.8%CVE-2020-10689MEDIUMA flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user EPSS 0.8%CVE-2021-42848MEDIUMAn information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user EPSS 0.8%CVE-2024-8001MEDIUMVIWIS LMS Print authorizationEPSS 0.8%CVE-2021-41112HIGHMissing Authorization in RundeckEPSS 0.7%CVE-2022-4366MEDIUMMissing Authorization in lirantal/daloradiusEPSS 0.7%CVE-2022-4501HIGHMega Addons For WPBakery Page Builder <= 4.3.0 - Authenticated (Subscriber+) Settings UpdateEPSS 0.7%CVE-2025-22609CRITICALCoolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)EPSS 0.7%CVE-2023-34463HIGHUnauthorized users can delete applications in DataEaseEPSS 0.7%CVE-2026-14357HIGHDevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' ParameterEPSS 0.7%CVE-2026-41871CRITICALApache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)EPSS 0.7%