Weaknesses of type CWE-862

8,854 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-43773MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 thrEPSS 0.3%CVE-2024-24840MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.4.11 - Broken Access Control on Duplicate Post vulnerabilityEPSS 0.3%CVE-2026-79044MEDIUMMissing authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised EPSS 0.3%CVE-2026-39595MEDIUMWordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-25348MEDIUMWordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-24957MEDIUMWordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-12411HIGHBroken Access Control in Canonical LXD DevLXD APIEPSS 0.3%CVE-2026-17601HIGHNexus Repository 3 - Wildcard Privilege Update Self-Escalation to AdministratorEPSS 0.3%CVE-2026-1981MEDIUMWinston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings DeletionEPSS 0.3%CVE-2026-24585MEDIUMWordPress Hyyan WooCommerce Polylang Integration plugin <= 1.5.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-56092HIGHBroken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.3%CVE-2026-25336MEDIUMWordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-69221MEDIUMLibreChat has Insufficient Access Control for Agent Permission QueriesEPSS 0.3%CVE-2026-18218MEDIUMKeycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzeroEPSS 0.3%CVE-2026-24598MEDIUMWordPress Multilanguage by BestWebSoft plugin <= 1.5.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-49394HIGHWordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerabilityEPSS 0.3%CVE-2026-10085MEDIUMOrdinary group/direct message member can enable group_constrained and remove all channel participantsEPSS 0.3%CVE-2025-53485HIGHSecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changesEPSS 0.3%CVE-2025-67917MEDIUMWordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-49902MEDIUMWordPress Login Page Customizer – Customizer Login Page, Admin Page, Custom Design plugin <= 2.1.1 - Broken Access Control vulnerabilityEPSS 0.3%