Weaknesses of type CWE-862

8,837 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-11890HIGHCrypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment BypassEPSS 0.3%CVE-2026-57335MEDIUMWordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-24403MEDIUMA missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerateEPSS 0.3%CVE-2026-87073MEDIUMTanium addressed an improper access controls vulnerability in Comply.EPSS 0.3%CVE-2026-66647MEDIUMWordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-81762MEDIUMWordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-27364MEDIUMWordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-55658HIGHGardens v2: StreamingEscrow buffer drains to the proposal beneficiary on cancel via the permissionless claim()EPSS 0.3%CVE-2026-86494HIGHIn JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issuesEPSS 0.3%CVE-2026-49385MEDIUMIn JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accountsEPSS 0.3%CVE-2025-69137MEDIUMWordPress Genemy theme <= 1.6.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-24561MEDIUMWordPress FluentBoards plugin <= 1.91.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-13652MEDIUMECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log DeletionEPSS 0.3%CVE-2026-24560MEDIUMWordPress Cloudinary plugin <= 3.3.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-65433MEDIUMWordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-40794MEDIUMWordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-5641MEDIUMOne Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-11867MEDIUMFrontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing AuthorizationEPSS 0.3%CVE-2026-57921MEDIUMIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpointEPSS 0.3%CVE-2026-28380MEDIUMBAC in Snapshot API allows deletion of unauthorized dashboard snapshotsEPSS 0.3%