Weaknesses of type CWE-862

8,853 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-49987MEDIUMWordPress CRM ERP Business Solution plugin <= 1.13 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2023-45272MEDIUMWordPress 10Web Map Builder for Google Maps plugin <= 1.0.73 - Notice Dismissal VulnerabilityEPSS 0.3%CVE-2023-23639MEDIUMWordPress MainWP Staging Extension Plugin <= 4.0.3 - Subscriber+ Arbitrary Plugin Activation VulnerabilityEPSS 0.3%CVE-2020-26231MEDIUMBypass of fix for CVE-2020-15247, Twig sandbox escapeEPSS 0.3%CVE-2019-25351HIGHCentova Cast 3.2.11 - Arbitrary File DownloadEPSS 0.3%CVE-2025-48275MEDIUMWordPress Visual Header plugin <= 1.3 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-1408MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests ManagementEPSS 0.3%CVE-2025-14447MEDIUMAnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options DeletionEPSS 0.3%CVE-2025-32260MEDIUMWordPress DethemeKit For Elementor plugin <= 2.1.10 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-6458MEDIUMWooCommerce Product Table Lite <= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-48898MEDIUMMoodle: some users can delete audiences of other reportsEPSS 0.3%CVE-2026-76086HIGHFormie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsEPSS 0.3%CVE-2026-26979NONEDiscourse: TL4 users are able to change status of restricted topicsEPSS 0.3%CVE-2026-1655MEDIUMEventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' ParameterEPSS 0.3%CVE-2026-76255MEDIUMRisky Command Safeguards Bypass through Splunk Web in Splunk EnterpriseEPSS 0.3%CVE-2025-14455MEDIUMImage Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery ManagementEPSS 0.3%CVE-2025-2104MEDIUMPage Builder: Pagelayer – Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post PublicationEPSS 0.3%CVE-2026-87534MEDIUMMissing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeriEPSS 0.3%CVE-2024-5600MEDIUMHappy SCSS Compiler - Compile SCSS to CSS automatically <= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-60086HIGHWordPress WP Voting Contest plugin <= 5.8 - Broken Access Control vulnerabilityEPSS 0.3%