Weaknesses of type CWE-862

10,118 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-9234CRITICALGutenKit <= 2.1.0 - Unauthenticated Arbitrary File UploadEPSS 10.4%CVE-2023-47681MEDIUMWordPress WooCommerce Checkout Manager plugin <= 7.3.0 - Broken Access Control vulnerabilityEPSS 9.2%CVE-2024-9707CRITICALHunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/ActivationEPSS 9.1%CVE-2022-1442HIGHMetform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information DisclosureEPSS 8.8%CVE-2022-1903—ARMember < 3.4.8 - Unauthenticated Admin Account TakeoverEPSS 8.7%CVE-2022-3124—Frontend File Manager < 21.3 - Unauthenticated File RenamingEPSS 8.3%CVE-2026-1830CRITICALQuick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File UploadEPSS 8.1%CVE-2015-20067—WP Attachment Export < 0.2.4 - Unauthenticated Posts DownloadEPSS 7.7%CVE-2026-8383MEDIUMLearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST APIEPSS 7.6%CVE-2023-32117CRITICALWordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerabilityEPSS 7.3%CVE-2021-25032—PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog CompromiseEPSS 7.1%CVE-2021-30713HIGHA permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able tEPSS 7.0%KEVCVE-2026-55638HIGH9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypassEPSS 6.6%CVE-2026-33484HIGHLangflow has Unauthenticated IDOR on Image DownloadsEPSS 5.9%CVE-2025-9133HIGHA missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions fromEPSS 5.5%CVE-2022-2461MEDIUMTransposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings ChangeEPSS 5.1%CVE-2025-10184HIGHOnePlus OxygenOS Telephony provider permission bypassEPSS 5.1%CVE-2025-59474MEDIUMJenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible tEPSS 5.0%CVE-2022-2841LOWCrowdStrike Falcon Uninstallation authorizationEPSS 5.0%CVE-2023-5612MEDIUMMissing Authorization in GitLabEPSS 4.9%