Weaknesses of type CWE-862

8,836 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-42320MEDIUMGLPI vulnerable to arbitrary file accessEPSS 0.3%CVE-2026-81922LOW"In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "EPSS 0.3%CVE-2026-81923LOWConcrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editorEPSS 0.3%CVE-2025-11890HIGHCrypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment BypassEPSS 0.3%CVE-2026-14548MEDIUMRay Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token UpdateEPSS 0.3%CVE-2024-13415MEDIUMFood Menu – Restaurant Menu & Online Ordering for WooCommerce <= 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings UpdateEPSS 0.3%CVE-2026-57654MEDIUMWordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-87073MEDIUMTanium addressed an improper access controls vulnerability in Comply.EPSS 0.3%CVE-2026-40794MEDIUMWordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57355MEDIUMWordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-69137MEDIUMWordPress Genemy theme <= 1.6.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57353MEDIUMWordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-11867MEDIUMFrontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing AuthorizationEPSS 0.3%CVE-2024-13652MEDIUMECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log DeletionEPSS 0.3%CVE-2026-18603MEDIUMCancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX ActionsEPSS 0.3%CVE-2026-24560MEDIUMWordPress Cloudinary plugin <= 3.3.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-78897MEDIUMMissing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtaiEPSS 0.3%CVE-2026-76368LOWMissing Authorization through Playbooks in Splunk SOAREPSS 0.3%CVE-2025-24403MEDIUMA missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerateEPSS 0.3%CVE-2026-73363MEDIUMWordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerabilityEPSS 0.3%