Weaknesses of type CWE-862

8,871 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-3150MEDIUMitning Student Homework Management System cross-site request forgeryEPSS 0.3%CVE-2025-52804HIGHWordPress Nuss theme <= 1.3.7.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-86441LOWMISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation DataEPSS 0.3%CVE-2026-57285MEDIUMA missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read perEPSS 0.3%CVE-2026-18244MEDIUMMissing Authorization in GitLabEPSS 0.3%CVE-2026-47089MEDIUMAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated EPSS 0.3%CVE-2026-86779LOWVisualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChartEPSS 0.3%CVE-2026-45007MEDIUMphpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information DisclosureEPSS 0.3%CVE-2026-24605MEDIUMWordPress X Addons for Elementor plugin <= 1.0.23 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-49920MEDIUMWordPress Web Accessibility By accessiBe plugin <= 2.10 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-89030MEDIUMBlog2Social WordPress Plugin < 9.1.0 User Email Disclosure via b2s_search_userEPSS 0.3%CVE-2026-77787LOWRank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulkEPSS 0.3%CVE-2025-68507MEDIUMWordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-14821LOWQuiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template DeletionEPSS 0.3%CVE-2026-42519MEDIUMA missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission tEPSS 0.3%CVE-2026-55542LOWSnipe-IT's S3 signature image retrieval lacks authorization before temporary URLEPSS 0.3%CVE-2026-28433LOWMisskey lacks resource ownership validationEPSS 0.3%CVE-2026-42522MEDIUMA missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permEPSS 0.3%CVE-2026-57300MEDIUMA missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read EPSS 0.3%CVE-2026-58244MEDIUMMissing Authorization Check in SAP Manufacturing Integration and Intelligence (MII)EPSS 0.3%