Weaknesses of type CWE-862

8,853 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-53986MEDIUMWordPress Hestia theme <= 3.2.10 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-67974HIGHWordPress WPLegalPages plugin <= 3.5.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-0856HIGHPGS Core <= 5.8.0 - Missing Authorization via Multiple FunctionsEPSS 0.3%CVE-2023-47770HIGHWordPress BeTheme theme <= 27.1.1 - Contributor+ Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-48155MEDIUMWordPress Residential Address Detection plugin <= 2.5.9 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-18121MEDIUMConcrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).EPSS 0.3%CVE-2026-76209MEDIUMphpMyFAQ before v4.1.6 Registration Bypass via APIEPSS 0.3%CVE-2025-69303HIGHWordPress ModelTheme Framework plugin < 2.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-32242MEDIUMWordPress Hive Support plugin <= 1.2.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-7756MEDIUMcode-projects E-Commerce Site cross-site request forgeryEPSS 0.3%CVE-2026-106323CRITICALMissing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineEPSS 0.3%CVE-2025-14481MEDIUMYoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' ParameterEPSS 0.3%CVE-2026-103433MEDIUMBake filesystem entitlement consent is skipped for certain secret and oci-layout definitionsEPSS 0.3%CVE-2024-24840MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.4.11 - Broken Access Control on Duplicate Post vulnerabilityEPSS 0.3%CVE-2026-17601HIGHNexus Repository 3 - Wildcard Privilege Update Self-Escalation to AdministratorEPSS 0.3%CVE-2026-1981MEDIUMWinston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings DeletionEPSS 0.3%CVE-2026-24957MEDIUMWordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-64179MEDIUMlakeFS: Unauthenticated access to API usage metricsEPSS 0.3%CVE-2025-54711HIGHWordPress Info Cards Plugin <= 1.0.11 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-18218MEDIUMKeycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzeroEPSS 0.3%