Weaknesses of type CWE-862

8,836 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-53439MEDIUMMissing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine otEPSS 0.3%CVE-2026-25456HIGHWordPress Automated FedEx live/manual rates with shipping labels plugin <= 5.1.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-28188HIGHWordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-40775HIGHWordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-33514MEDIUMDiscourse: Information Disclosure in Form Template API Due to Missing AuthorizationEPSS 0.3%CVE-2025-31540MEDIUMWordPress ACME Divi Modules plugin <= 1.3.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-58222MEDIUMWordPress Team Manager plugin <= 2.6.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-1860MEDIUMKali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data ExposureEPSS 0.3%CVE-2025-67563MEDIUMWordPress Post SMTP plugin <= 3.6.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-4795MEDIUMA missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2)C0, GS1200-8v3 firmware versions through 1.0EPSS 0.3%CVE-2026-81923LOWConcrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editorEPSS 0.3%CVE-2025-31865MEDIUMWordPress CartBoss plugin <= 4.1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-52179MEDIUMWordPress Product Expiry for WooCommerce plugin <= 2.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-39716MEDIUMWordPress Flipmart theme <= 2.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-42320MEDIUMGLPI vulnerable to arbitrary file accessEPSS 0.3%CVE-2025-22291MEDIUMWordPress LTL Freight Quotes – Worldwide Express Edition plugin <= 5.0.20 - Arbitrary Content Deletion vulnerabilityEPSS 0.3%CVE-2026-81922LOW"In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "EPSS 0.3%CVE-2026-0554MEDIUMNotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics ResetEPSS 0.3%CVE-2026-39688MEDIUMWordPress WP Frontend Profile plugin <= 1.3.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-40742MEDIUMWordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerabilityEPSS 0.3%