Weaknesses of type CWE-862

8,796 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-27328MEDIUMWordPress EduBlink theme <= 2.0.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-10606MEDIUMWP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings UpdateEPSS 0.3%CVE-2024-33636MEDIUMWordPress WP Page Post Widget Clone plugin <= 1.0.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-27042MEDIUMWordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-18570MEDIUMKeycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowedEPSS 0.3%CVE-2024-55995MEDIUMWordPress Torod plugin <= 1.7 - Settings Change vulnerabilityEPSS 0.3%CVE-2026-82267MEDIUMKomodo Resource Identifier Disclosure and Audit Log Pollution Before Permission CheckEPSS 0.3%CVE-2026-44794MEDIUMNautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to referenceEPSS 0.3%CVE-2026-77013MEDIUMIcollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method DispatchEPSS 0.3%CVE-2026-3895MEDIUMWPBakery Page Builder Addons by Livemesh <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-1831LOWYayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and ActivationEPSS 0.3%CVE-2026-91015MEDIUMMaster Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expiredEPSS 0.3%CVE-2024-37175MEDIUM[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)EPSS 0.3%CVE-2026-15237MEDIUMHotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST EndpointEPSS 0.3%CVE-2026-16608MEDIUMDownload Monitor < 5.2.6 - Unauthenticated Download Log InjectionEPSS 0.3%CVE-2026-16962MEDIUMTamara Checkout <= 1.9.9.20 - Unauthenticated Order Status ManipulationEPSS 0.3%CVE-2025-10637MEDIUMSocial Feed Gallery <= 4.9.2 - Missing Authorization to Unauthenticated Information ExposureEPSS 0.3%CVE-2026-77702MEDIUMEventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_tokenEPSS 0.3%CVE-2026-18779MEDIUMTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_bookedEPSS 0.3%CVE-2025-14428MEDIUMMy Sticky Elements <= 2.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead DeletionEPSS 0.3%