Weaknesses of type CWE-862

8,871 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-44771MEDIUMMissing Authorization check in SAP S/4HANA (Draft operation)EPSS 0.3%CVE-2024-11851MEDIUMNitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient UpdateEPSS 0.3%CVE-2025-52803HIGHWordPress Sala theme <= 1.1.3 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-84927LOWEmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews ModificationEPSS 0.3%CVE-2026-70547MEDIUMPotential unauthorized metadata exposure in JFrog ArtifactoryEPSS 0.3%CVE-2025-68896MEDIUMWordPress WDV One Page Docs plugin <= 1.2.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-3831MEDIUMDatabase for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via ShortcodeEPSS 0.3%CVE-2026-0548MEDIUMTutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment DeletionEPSS 0.3%CVE-2026-89007LOWBookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing AuthorizationEPSS 0.3%CVE-2025-27356MEDIUMWordPress Sticky Header On Scroll plugin <= 1.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57286MEDIUMA missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtaEPSS 0.3%CVE-2026-63092MEDIUMkirby-modules License Key Disclosure via modules/activate DialogEPSS 0.3%CVE-2026-25335MEDIUMWordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-47728MEDIUMBugsink: Project scoping missing in sourcemap and debug-file lookupEPSS 0.3%CVE-2025-22280HIGHWordPress DefendWP Firewall Plugin <= 1.1.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-76963MEDIUMMissing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP PlatformEPSS 0.3%CVE-2026-84659MEDIUMJenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force thEPSS 0.3%CVE-2026-44770MEDIUMMissing Authorization check in SAP S/4 HANA (Create Single Payment)EPSS 0.3%CVE-2026-27672MEDIUMMissing Authorization check in Material Master ApplicationEPSS 0.3%CVE-2025-11742MEDIUMWPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information ExposureEPSS 0.3%