Weaknesses of type CWE-862

8,854 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-84217MEDIUMWordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-106489MEDIUMBackstage: Improper authorization enforcement for TechDocs static contentEPSS 0.3%CVE-2026-25309HIGHWordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-56023MEDIUMWordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-78597MEDIUMMissing Authorization in Kibana Entity Store Leading to Unauthorized API Key CreationEPSS 0.3%CVE-2026-10085MEDIUMOrdinary group/direct message member can enable group_constrained and remove all channel participantsEPSS 0.3%CVE-2026-84805MEDIUMKimai 2.61.0 before 2.63.0 Authentication Bypass via APIEPSS 0.3%CVE-2025-63041MEDIUMWordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-32416MEDIUMWordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-39594MEDIUMWordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-53485HIGHSecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changesEPSS 0.3%CVE-2026-94120HIGHWordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-8632MEDIUMKB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply ExposureEPSS 0.3%CVE-2026-32385MEDIUMWordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-28619MEDIUMWordPress Resoto theme <= 1.0.8 - Broken Access Control to Arbitrary Plugin ActivationEPSS 0.3%CVE-2026-27111MEDIUMKargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API EndpointsEPSS 0.3%CVE-2026-14332MEDIUMEcwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' ActionEPSS 0.3%CVE-2026-32390MEDIUMWordPress Nanosoft theme < 1.3.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-45210MEDIUMWordPress Broadstreet Ads plugin <= 1.52.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-32373MEDIUMWordPress SMS Alert Order Notifications plugin <= 3.9.0 - Broken Access Control vulnerabilityEPSS 0.3%