Weaknesses of type CWE-862

8,874 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-64251MEDIUMWordPress Ultimate Learning Pro plugin <= 3.9.3 - Arbitrary Content Deletion vulnerabilityEPSS 0.3%CVE-2026-34722MEDIUMZammad is missing authorization in ticket create endpointEPSS 0.3%CVE-2026-39749MEDIUMWordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-39360MEDIUMRustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltrationEPSS 0.3%CVE-2026-97239MEDIUMWordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-48117MEDIUMWordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-22739MEDIUMWordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-13317MEDIUMAppointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' ParameterEPSS 0.3%CVE-2025-13441MEDIUMHide Category by User Role for WooCommerce <= 2.3.1 - Missing Authorization to Unauthenticated Cache FlushingEPSS 0.3%CVE-2025-11370MEDIUMDepicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule UpdatesEPSS 0.3%CVE-2025-6106MEDIUMWuKongOpenSource WukongCRM AdminRoleController.java cross-site request forgeryEPSS 0.3%CVE-2025-14080MEDIUMFrontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post ModificationEPSS 0.3%CVE-2026-34245MEDIUMAVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast HijackingEPSS 0.3%CVE-2026-87522MEDIUMMissing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeriEPSS 0.3%CVE-2022-41650MEDIUMWordPress Custom Content by Country plugin <= 3.1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-31618MEDIUMWordPress Connector to CiviCRM with CiviMcRestFace plugin <= 1.0.10 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-78968MEDIUMMissing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to EPSS 0.3%CVE-2025-57991MEDIUMWordPress Clariti Plugin <= 1.2.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-24382HIGHWordPress News Magazine X theme <= 1.2.50 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-57990MEDIUMWordPress Blog Designer Plugin <= 3.1.8 - Broken Access Control VulnerabilityEPSS 0.3%