Weaknesses of type CWE-862

8,867 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-22363MEDIUMWordPress Allada T-shirt Designer for Woocommerce plugin <= 1.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-41016HIGHMultiple vulnerabilities in DFUSION by DavantisEPSS 0.3%CVE-2026-79208MEDIUMMissing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted nEPSS 0.3%CVE-2025-11442MEDIUMJhumanJ OpnForm API Endpoint cross-site request forgeryEPSS 0.3%CVE-2024-44117MEDIUMMultiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 0.3%CVE-2026-102249MEDIUMREBUILD file-editor-save authorizationEPSS 0.3%CVE-2025-5410MEDIUMMist Community Edition middleware.py session_start_response cross-site request forgeryEPSS 0.3%CVE-2024-53813MEDIUMWordPress WP Travel plugin <= 9.6.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-66532MEDIUMWordPress Powerlift theme < 3.2.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-96603MEDIUMAbdurrab5 online-makeup-store Admin functions.php confirm_user authorizationEPSS 0.3%CVE-2025-12721MEDIUMg-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information ExposureEPSS 0.3%CVE-2025-6865MEDIUMDaiCuo index cross-site request forgeryEPSS 0.3%CVE-2026-3155LOWOneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'EPSS 0.3%CVE-2024-6155MEDIUMGreenshift – animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-39650MEDIUMWordPress UnitechPay plugin <= 1.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-14397HIGHPostem Ipsum <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation in postem_ipsum_generate_usersEPSS 0.3%CVE-2025-13381MEDIUMAI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Missing Authorization to Unauthenticated Media File UploadsEPSS 0.3%CVE-2025-6664MEDIUMCodeAstro Patient Record Management System cross-site request forgeryEPSS 0.3%CVE-2024-31307MEDIUMWordPress Easy Social Share Buttons plugin <= 9.4 - Multiple Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-5811MEDIUMListly: Listicles For WordPress <= 2.7 - Unauthenticated Arbitrary Transient DeletionEPSS 0.3%