Weaknesses of type CWE-862

8,874 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-11894MEDIUMShelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings UpdateEPSS 0.3%CVE-2025-62884MEDIUMWordPress Coupon Affiliates plugin <= 7.2.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-58603MEDIUMWordPress Surfer Plugin <= 1.6.4.574 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-4522MEDIUMIDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete FunctionEPSS 0.3%CVE-2025-60155MEDIUMWordPress WP Virtual Assistant Plugin <= 3.0 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-92713HIGHModula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' ParameterEPSS 0.3%CVE-2025-53291MEDIUMWordPress Spreadconnect plugin <= 2.1.5 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-57925MEDIUMIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tagsEPSS 0.3%CVE-2025-53348MEDIUMWordPress Kalium Theme <= 3.18.3 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-12855MEDIUMAdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment DeletionEPSS 0.3%CVE-2025-13093MEDIUMDevs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag UpdateEPSS 0.3%CVE-2026-105680MEDIUMGhost: Authorization Issue Allowed Author Role to Delete any PostEPSS 0.3%CVE-2026-69113MEDIUMCap v0.3.1 Broken Access Control via video comment endpointEPSS 0.3%CVE-2023-5056MEDIUMSkupper-operator: privelege escalation via config mapEPSS 0.3%CVE-2025-60129MEDIUMWordPress Yext Plugin <= 1.1.3 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-13419MEDIUMGuest posting / Frontend Posting / Front Editor – WP Front User Submit <= 5.0.0 - Missing Authorization to Unauthenticated Media DeletionEPSS 0.3%CVE-2025-49884MEDIUMWordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-47565MEDIUMWordPress EventON plugin <= 4.9.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-8547HIGHInsufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromisEPSS 0.3%CVE-2025-14029MEDIUMCommunity Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' ParameterEPSS 0.3%