Weaknesses of type CWE-862

8,882 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-18120MEDIUMMissing Authorization in legacy Express entries search endpoint allows disclosure of Express entry dataEPSS 0.3%CVE-2025-3780MEDIUMWCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings ModificationEPSS 0.3%CVE-2026-0817MEDIUMCampaignEvents API missing authorization exposes meeting and chat URLsEPSS 0.3%CVE-2026-79104MEDIUMMissing authorization in Sensor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process tEPSS 0.3%CVE-2026-76902MEDIUMCordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`EPSS 0.3%CVE-2026-79184MEDIUMMissing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process EPSS 0.3%CVE-2026-54029MEDIUMLibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User FilterEPSS 0.3%CVE-2026-79085MEDIUMMissing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process EPSS 0.3%CVE-2025-46535MEDIUMWordPress Custom Login and Registration plugin <= 1.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-69063HIGHWordPress New User Approve plugin <= 3.2.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-25030MEDIUMWordPress Buy Me a Coffee plugin <= 3.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-54743MEDIUMWordPress Download After Email Plugin 2.1.5-2.1.6 - Other Vulnerability Type VulnerabilityEPSS 0.3%CVE-2025-52800HIGHWordPress The E-Commerce ERP <= 2.1.1.3 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-32221MEDIUMWordPress EazyDocs plugin <= 2.7.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-32216MEDIUMWordPress Spider Elements – Addons for Elementor plugin <= 1.6.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-42473MEDIUMMissing Authorization Check In S/4HANA (Manage Withholding Tax Items)EPSS 0.3%CVE-2025-67548MEDIUMWordPress WP Delicious plugin <= 1.9.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-104910MEDIUMMISP Information Disclosure via Related Events Listing Bypassing Per-Event AuthorizationEPSS 0.3%CVE-2025-52801HIGHWordPress TheBooking Plugin <= 1.4.4 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-68484CRITICALCash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verifyEPSS 0.3%