Weaknesses of type CWE-862

8,853 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-45243MEDIUMSensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (LinuxEPSS 0.3%CVE-2026-18121MEDIUMConcrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).EPSS 0.3%CVE-2025-12157MEDIUMSimple User Capabilities <= 1.0 - Missing Authorization to Unauthenticated Capability ResetEPSS 0.3%CVE-2025-69303HIGHWordPress ModelTheme Framework plugin < 2.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-1851MEDIUMaffiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_listEPSS 0.3%CVE-2026-49378MEDIUMIn JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletionEPSS 0.3%CVE-2025-22299MEDIUMWordPress AI for SEO plugin <= 1.2.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-25336MEDIUMWordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-11725MEDIUMAruba HiSpeed Cache <= 3.0.2 - Missing Authorization to Unauthenticated Plugin's Settings ModificationEPSS 0.3%CVE-2026-1981MEDIUMWinston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings DeletionEPSS 0.3%CVE-2026-104406HIGHWordPress picu plugin <= 3.10.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-24598MEDIUMWordPress Multilanguage by BestWebSoft plugin <= 1.5.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-43773MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 thrEPSS 0.3%CVE-2026-26741HIGHPX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism. When switching from Auto mode to Manual mEPSS 0.3%CVE-2026-63204LOWZammad: Authenticated agents can read AI summary error messages from inaccessible ticketsEPSS 0.3%CVE-2026-12411HIGHBroken Access Control in Canonical LXD DevLXD APIEPSS 0.3%CVE-2026-56092HIGHBroken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.3%CVE-2026-17601HIGHNexus Repository 3 - Wildcard Privilege Update Self-Escalation to AdministratorEPSS 0.3%CVE-2026-24957MEDIUMWordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-24840MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.4.11 - Broken Access Control on Duplicate Post vulnerabilityEPSS 0.3%