Weaknesses of type CWE-862

8,451 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-47681MEDIUMWordPress WooCommerce Checkout Manager plugin <= 7.3.0 - Broken Access Control vulnerabilityEPSS 9.2%CVE-2024-9707CRITICALHunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/ActivationEPSS 9.1%CVE-2022-1442HIGHMetform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information DisclosureEPSS 8.8%CVE-2022-1903—ARMember < 3.4.8 - Unauthenticated Admin Account TakeoverEPSS 8.7%CVE-2026-1830CRITICALQuick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File UploadEPSS 8.1%CVE-2015-20067—WP Attachment Export < 0.2.4 - Unauthenticated Posts DownloadEPSS 7.7%CVE-2026-8383MEDIUMLearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST APIEPSS 7.6%CVE-2023-32117CRITICALWordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerabilityEPSS 7.3%CVE-2021-30713HIGHA permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able tEPSS 7.0%KEVCVE-2022-3124—Frontend File Manager < 21.3 - Unauthenticated File RenamingEPSS 6.9%CVE-2021-25032—PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog CompromiseEPSS 6.7%CVE-2026-0628HIGHInsufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install EPSS 6.6%CVE-2026-33484HIGHLangflow has Unauthenticated IDOR on Image DownloadsEPSS 5.8%CVE-2025-9133HIGHA missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions fromEPSS 5.5%CVE-2025-59474MEDIUMJenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible tEPSS 4.9%CVE-2022-2841LOWCrowdStrike Falcon Uninstallation authorizationEPSS 4.9%CVE-2023-5612MEDIUMMissing Authorization in GitLabEPSS 4.9%CVE-2022-2461MEDIUMTransposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings ChangeEPSS 4.8%CVE-2019-25141CRITICALEasy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options UpdateEPSS 4.5%CVE-2023-6038CRITICALLocal File Inclusion in h2oai/h2o-3EPSS 4.3%