Weaknesses of type CWE-862

8,903 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-8268MEDIUMAi Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And DeletionEPSS 0.3%CVE-2026-9824MEDIUMRemote cluster metadata enumeration via /share-channel autocompleteEPSS 0.3%CVE-2025-67576MEDIUMWordPress Simple Link Directory plugin <= 8.8.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-12877MEDIUMIDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post DeletionEPSS 0.3%CVE-2026-70438MEDIUMA missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission toEPSS 0.3%CVE-2026-5572MEDIUMTechnostrobe HI-LED-WR120-G2 cross-site request forgeryEPSS 0.3%CVE-2026-81761MEDIUMWordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-63079MEDIUMWordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-12392MEDIUMCryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status UpdateEPSS 0.3%CVE-2024-9628MEDIUMWPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot APIEPSS 0.3%CVE-2026-70433MEDIUMMissing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentiEPSS 0.3%CVE-2025-13964MEDIUMLearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course ModificationEPSS 0.3%CVE-2026-86417MEDIUMMISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized UsersEPSS 0.3%CVE-2025-68993MEDIUMWordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-75046MEDIUMIn JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpointEPSS 0.3%CVE-2026-70445MEDIUMMissing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credeEPSS 0.3%CVE-2024-9630MEDIUMWPS Telegram Chat <= 4.6.0 - Missing Authorization to Information ExposureEPSS 0.3%CVE-2026-65491MEDIUMWordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-25459MEDIUMWordPress Sober theme <= 3.5.12 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-24356MEDIUMWordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerabilityEPSS 0.3%