Weaknesses of type CWE-862

8,903 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-53487MEDIUMKite has an authenticated cluster RBAC bypass in /api/v1/overviewEPSS 0.3%CVE-2026-49054MEDIUMWordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-4102MEDIUMPricing Table <= 2.0.1 - Missing AuthorizationEPSS 0.3%CVE-2025-15327MEDIUMTanium addressed an improper access controls vulnerability in Deploy.EPSS 0.3%CVE-2026-13241MEDIUMParagraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061EPSS 0.3%CVE-2026-6883LOWMissing Authorization in GitLabEPSS 0.3%CVE-2026-13240MEDIUMParagraphs - Less critical - Access bypass - SA-CONTRIB-2026-060EPSS 0.3%CVE-2025-3953MEDIUMWP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings UpdateEPSS 0.3%CVE-2026-24972MEDIUMWordPress Elated Listing plugin <= 1.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-11632MEDIUMCall Now Button <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Multiple FunctionsEPSS 0.3%CVE-2024-37210MEDIUMWordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-15326MEDIUMTanium addressed an improper access controls vulnerability in Patch.EPSS 0.3%CVE-2026-73842CRITICALOpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutationEPSS 0.3%CVE-2026-34247MEDIUMAVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket NotificationsEPSS 0.3%CVE-2025-60079HIGHWordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerabilityEPSS 0.3%CVE-2024-11929MEDIUMResponsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-78596MEDIUMMissing Authorization in Kibana Leading to Unauthorized Cross-Space Write OperationsEPSS 0.3%CVE-2026-27151LOWDiscourse doesn't validate destination topic when moving postsEPSS 0.3%CVE-2025-66088HIGHWordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-24747MEDIUMWordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerabilityEPSS 0.3%