Weaknesses of type CWE-862

8,903 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-78596MEDIUMMissing Authorization in Kibana Leading to Unauthorized Cross-Space Write OperationsEPSS 0.3%CVE-2025-64148MEDIUMA missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerateEPSS 0.3%CVE-2023-48761MEDIUMWordPress JetElements For Elementor plugin <= 2.6.13 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-1780MEDIUMBuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limited Settings UpdateEPSS 0.3%CVE-2025-24747MEDIUMWordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-60079HIGHWordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerabilityEPSS 0.3%CVE-2024-11929MEDIUMResponsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-10860MEDIUMNextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason SubmissionEPSS 0.3%CVE-2024-42372MEDIUMMissing Authorization check in SAP NetWeaver AS Java (System Landscape Directory)EPSS 0.3%CVE-2024-13358MEDIUMBuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings UpdateEPSS 0.3%CVE-2025-43788MEDIUMThe organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through EPSS 0.3%CVE-2026-27151LOWDiscourse doesn't validate destination topic when moving postsEPSS 0.3%CVE-2025-59581MEDIUMWordPress Ibtana Plugin <= 1.2.5.3 - Arbitrary Content Deletion VulnerabilityEPSS 0.3%CVE-2025-48444MEDIUMQuick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064EPSS 0.3%CVE-2026-100305MEDIUMTDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission EndpointEPSS 0.3%CVE-2025-66088HIGHWordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2022-47339MEDIUMIn cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege witEPSS 0.3%CVE-2025-66054HIGHWordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-24095MEDIUMMissing Permission Check on Analyze Configuration PageEPSS 0.3%CVE-2025-64277MEDIUMWordPress ChatBot plugin <= 7.3.9 - Broken Access Control vulnerabilityEPSS 0.3%