Weaknesses of type CWE-862

8,874 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-58003MEDIUMWordPress Javo Core Plugin <= 3.0.0.266 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-32783MEDIUMWordPress Advanced Testimonial Carousel for Elementor plugin <= 3.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-33495MEDIUMOry Oathkeeper has an authentication bypass by usage of untrusted headerEPSS 0.3%CVE-2025-7040HIGHCloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings ActionEPSS 0.3%CVE-2024-31347MEDIUMWordPress Tracking Code Manager plugin <= 2.1.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-66136MEDIUMWordPress Carter for Elementor plugin <= 1.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-32331MEDIUMWordPress Textmetrics plugin <= 3.6.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-1781MEDIUMMC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription DeletionEPSS 0.3%CVE-2024-37176MEDIUMMissing Authorization check in SAP BW/4HANA Transformation and DTPEPSS 0.3%CVE-2025-68850HIGHWordPress Sell Downloads plugin <= 1.1.12 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-66142MEDIUMWordPress Comparimager for Elementor plugin <= 1.0.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-66141MEDIUMWordPress Scroller plugin <= 2.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-68036HIGHWordPress CubeWP plugin <= 1.1.27 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-47585MEDIUMWordPress Booking and Rental Manager plugin <= 2.3.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-65089MEDIUMXWiki view file macro: User can view content of office file without view rights on the attachmentEPSS 0.3%CVE-2026-92750HIGHHarness through 3.3.0 Missing Access Control via infraproviders endpointEPSS 0.3%CVE-2026-105852MEDIUMPayload relationship-query authorization bypassEPSS 0.3%CVE-2025-2246MEDIUMMissing Authorization in GitLabEPSS 0.3%CVE-2024-33684MEDIUMWordPress Save as PDF plugin by Pdfcrowd plugin <= 3.2.0 - Broken Access Control to Stored XSS vulnerabilityEPSS 0.3%CVE-2024-5607MEDIUMGDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site ScriptingEPSS 0.3%