Weaknesses of type CWE-862

8,495 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-2039HIGHGFI Archiver MArc.Store Missing Authorization Authentication Bypass VulnerabilityEPSS 0.7%CVE-2026-57518HIGHPagekit CMS 1.0.18 Privilege Escalation via UserApiControllerEPSS 0.7%CVE-2024-29240MEDIUMMissing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allowsEPSS 0.7%CVE-2024-1710HIGHAddon Library <= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.7%CVE-2026-13765HIGHLearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST EndpointsEPSS 0.7%CVE-2026-45677HIGHRocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoSEPSS 0.7%CVE-2025-49747CRITICALAzure Machine Learning Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-0829MEDIUMFrontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email SendingEPSS 0.7%CVE-2022-22107MEDIUMDayByDay CRM - Missing Authorization when Viewing AppointmentsEPSS 0.7%CVE-2024-1072HIGHWebsite Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Authorization via seedprod_lite_new_lpageEPSS 0.7%CVE-2022-24190HIGHThe /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is nEPSS 0.7%CVE-2022-22108MEDIUMDayByDay CRM - Missing Authorization when Viewing AbsencesEPSS 0.7%CVE-2022-38512MEDIUMThe Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions befEPSS 0.7%CVE-2022-0726MEDIUMMissing Authorization in chocobozzz/peertubeEPSS 0.7%CVE-2021-4351MEDIUMFrontend File Manager <= 18.2 - Unauthenticated Post Meta ChangeEPSS 0.7%CVE-2023-39997MEDIUMWordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control VulnerabilityEPSS 0.7%CVE-2023-0619MEDIUMKraken.io Image Optimizer <= 2.6.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Options UpdateEPSS 0.7%CVE-2023-23988HIGHWordPress My Tickets plugin <= 1.9.11 - Payment Bypass VulnerabilityEPSS 0.7%CVE-2026-26268HIGHCursor sandbox escape via Git hooksEPSS 0.7%CVE-2023-43652HIGHNon-MFA account takeover via using only SSH public key to login in jumpserverEPSS 0.7%