Weaknesses of type CWE-862

8,836 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-52813HIGHWordPress MobiLoud <= 4.6.5 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-13312MEDIUMOpen Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076EPSS 0.3%CVE-2023-40327MEDIUMWordPress Putler Connector for WooCommerce plugin <= 2.12.0 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-69115HIGHOpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration EndpointsEPSS 0.3%CVE-2026-53626HIGHGLPI: Arbitrary Document Read via Form Context Authorization BypassEPSS 0.3%CVE-2023-46203MEDIUMWordPress Just Custom Fields plugin <= 3.3.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-13318MEDIUMBooking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' ParameterEPSS 0.3%CVE-2026-95297MEDIUMMissing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via EPSS 0.3%CVE-2026-1786MEDIUMTwitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings UpdateEPSS 0.3%CVE-2026-72966MEDIUMWindows Remote Access Connection Manager Tampering VulnerabilityEPSS 0.3%CVE-2025-24737MEDIUMWordPress WP Helper Premium plugin <= 4.6.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-7822MEDIUMWP Wallcreeper <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/DisableEPSS 0.3%CVE-2025-15235HIGHQuanta Computer｜QOCA aim AI Medical Cloud Platform - Missing AuthorizationEPSS 0.3%CVE-2023-43090MEDIUMGnome-shell: screenshot tool allows viewing open windows when session is lockedEPSS 0.3%CVE-2025-3964MEDIUMwithstars Books-Management-System Article del cross-site request forgeryEPSS 0.3%CVE-2026-61936MEDIUMWindows Defender Firewall Service Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-22485MEDIUMWordPress My Album Gallery plugin <= 1.0.4 - Arbitrary File Deletion vulnerabilityEPSS 0.3%CVE-2025-68048HIGHWordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-3979MEDIUMdazhouda lecms Password Change index.php cross-site request forgeryEPSS 0.3%CVE-2025-30855HIGHWordPress Ads by WPQuads plugin <= 2.0.87.1 - Broken Access Control VulnerabilityEPSS 0.3%