Weaknesses of type CWE-862

8,869 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-33420MEDIUMVaultwarden missing authorization check allows Manager-role users to enumerate all collectionsEPSS 0.3%CVE-2025-5410MEDIUMMist Community Edition middleware.py session_start_response cross-site request forgeryEPSS 0.3%CVE-2025-13381MEDIUMAI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Missing Authorization to Unauthenticated Media File UploadsEPSS 0.3%CVE-2025-5811MEDIUMListly: Listicles For WordPress <= 2.7 - Unauthenticated Arbitrary Transient DeletionEPSS 0.3%CVE-2025-11029MEDIUMgivanz Vvveb cross-site request forgeryEPSS 0.3%CVE-2026-14853MEDIUMWooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing AuthorizationEPSS 0.3%CVE-2025-6865MEDIUMDaiCuo index cross-site request forgeryEPSS 0.3%CVE-2025-31530MEDIUMWordPress Google SEO Pressor Snippet plugin <= 2.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-28996MEDIUMWordPress GPP Slideshow plugin <= 1.3.5 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-22667MEDIUMWordPress Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets plugin <= 1.8.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-31529MEDIUMWordPress Slider Path for Elementor plugin <= 3.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-10665MEDIUMYaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/DeletionEPSS 0.3%CVE-2023-26002MEDIUMWordPress 6Storage Rentals <= 2.19.5 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-7491MEDIUMHUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to UnsubscribeEPSS 0.3%CVE-2026-2208MEDIUMWeKan Rules rules.js RulesBleed authorizationEPSS 0.3%CVE-2025-10054MEDIUMELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role RemovalEPSS 0.3%CVE-2024-32792MEDIUMWordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-54222MEDIUMWordPress Seraphinite Accelerator plugin <= 2.22.15 - Authenticated Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-32295MEDIUMWordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-47534MEDIUMWordPress Wordpress Auto Spinner plugin <= 3.25.0 - Broken Access Control VulnerabilityEPSS 0.3%