Weaknesses of type CWE-862

10,142 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-5304CRITICALPT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add FunctionEPSS 0.7%CVE-2024-21216CRITICALVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areEPSS 0.7%CVE-2022-2696MEDIUMRestaurant Menu – Food Ordering System – Table Reservation <= 2.3.0 - Missing Authorization on AJAX ActionsEPSS 0.7%CVE-2023-28657HIGHImproper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected prodEPSS 0.7%CVE-2026-72868CRITICALDokploy: Member-role RCE as host root via destination.testConnection rclone shell injectionEPSS 0.7%CVE-2026-72876CRITICALDokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*EPSS 0.7%CVE-2023-40203MEDIUMWordPress MailChimp Forms by MailMunch plugin <= 3.1.4 - Broken Access ControlEPSS 0.7%CVE-2023-1865MEDIUMYourChannel <= 1.2.3 - Missing Authorization to Plugin Settings ResetEPSS 0.7%CVE-2019-25143MEDIUMGDPR Cookie Compliance <= 4.0.2 - Missing AuthorizationEPSS 0.7%CVE-2026-115574MEDIUMZulip: Custom profile fields can be read by logged-out visitors in organization with web-public channelsEPSS 0.7%CVE-2023-33996HIGHWordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.10 - Broken Access Control vulnerabilityEPSS 0.7%CVE-2026-109444CRITICALOpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt InjectionEPSS 0.7%CVE-2025-8342HIGHWooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication BypassEPSS 0.7%CVE-2022-22107MEDIUMDayByDay CRM - Missing Authorization when Viewing AppointmentsEPSS 0.7%CVE-2022-22108MEDIUMDayByDay CRM - Missing Authorization when Viewing AbsencesEPSS 0.7%CVE-2024-11104HIGHSky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options UpdateEPSS 0.7%CVE-2026-26268HIGHCursor sandbox escape via Git hooksEPSS 0.7%CVE-2024-11848HIGHNitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateEPSS 0.7%CVE-2023-44227HIGHWordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File DeletionEPSS 0.7%CVE-2021-38431MEDIUMAdvantech WebAccess SCADAEPSS 0.7%