Weaknesses of type CWE-862

8,860 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-41016HIGHMultiple vulnerabilities in DFUSION by DavantisEPSS 0.3%CVE-2025-66527MEDIUMWordPress Lobo theme <= 2.8.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-6798MEDIUMRSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing AuthorizationEPSS 0.3%CVE-2026-1253MEDIUMGroup Chat & Video Chat by AtomChat <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options UpdateEPSS 0.3%CVE-2025-23187MEDIUMMissing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)EPSS 0.3%CVE-2026-44585MEDIUMPaymenter: Broken object level authorization via service reference manipulation on ticket creationEPSS 0.3%CVE-2025-27013MEDIUMWordPress MediCenter theme < 14.7 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2024-6750HIGHSocial Auto Poster <= 5.3.14 - Missing Authorization via Multiple FunctionsEPSS 0.3%CVE-2025-66075MEDIUMWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-15034MEDIUMflask-dashboard Flask-MonitoringDashboard cross-site request forgeryEPSS 0.3%CVE-2025-68995MEDIUMWordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-10313HIGHFind And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-55072MEDIUMA Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their EPSS 0.3%CVE-2025-43838MEDIUMWordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change VulnerabilityEPSS 0.3%CVE-2025-47580MEDIUMWordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-31882MEDIUMWordPress Webinar Plugin <= 1.33.28 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-58969MEDIUMWordPress Custom Login URL Plugin <= 1.0.2 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-66525MEDIUMWordPress Elastic Email Sender plugin <= 1.2.20 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-22363MEDIUMWordPress Allada T-shirt Designer for Woocommerce plugin <= 1.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-79208MEDIUMMissing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted nEPSS 0.3%