Weaknesses of type CWE-862

10,142 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-41869CRITICALApache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)EPSS 0.7%CVE-2024-1934HIGHWP Compress – Image Optimizer <= 6.11.08 - Missing Authorization to Unauthenticated CDN ModificationEPSS 0.7%CVE-2022-3920MEDIUMConsul Peering Imported Nodes/Services LeakEPSS 0.7%CVE-2026-2038HIGHGFI Archiver MArc.Core Missing Authorization Authentication Bypass VulnerabilityEPSS 0.7%CVE-2025-31377HIGHWordPress Woo Product Feed For Marketing Channels plugin <= 1.9.0 - Broken Access Control VulnerabilityEPSS 0.7%CVE-2022-4555MEDIUMWP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin DeactivationEPSS 0.7%CVE-2026-74040CRITICALWazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_workerEPSS 0.7%CVE-2024-11643HIGHAccessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option UpdateEPSS 0.7%CVE-2023-24448MEDIUMA missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to aEPSS 0.7%CVE-2023-24453MEDIUMA missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attackeEPSS 0.7%CVE-2026-32583MEDIUMWordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerabilityEPSS 0.7%CVE-2024-12594HIGHALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege EscalationEPSS 0.7%CVE-2023-25035MEDIUMWordPress Quick Contact Form plugin <= 8.0.3.1 - Broken Access Control vulnerabilityEPSS 0.7%CVE-2024-54466MEDIUMAn authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS VEPSS 0.7%CVE-2026-88198HIGHMicrosoft Office SharePoint Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-56768HIGHSeahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET MethodEPSS 0.7%CVE-2023-3442HIGHMissing Authorization in Jenkins plug-in for ServiceNow DevOpsEPSS 0.7%CVE-2023-23895MEDIUMWordPress WP Time Slots Booking Form plugin <= 1.1.82 - Broken Access Control vulnerabilityEPSS 0.7%CVE-2023-35937MEDIUMMetersphere missing permission checkEPSS 0.7%CVE-2025-21396HIGHMicrosoft Account Elevation of Privilege VulnerabilityEPSS 0.7%