Weaknesses of type CWE-862

8,903 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-87513MEDIUMMissing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to EPSS 0.3%CVE-2025-9637MEDIUMQuiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response UploadsEPSS 0.3%CVE-2025-49974MEDIUMWordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-47688HIGHFOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedulesEPSS 0.3%CVE-2025-53200MEDIUMWordPress ChatBot plugin <= 6.7.3 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-2832MEDIUMmingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 cross-site request forgeryEPSS 0.3%CVE-2026-27769LOWConnected Workspaces: Malicious remote server can manipulate arbitrary user's statusEPSS 0.3%CVE-2024-10536MEDIUMFancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode ExportEPSS 0.3%CVE-2026-12973MEDIUMPayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status ModificationEPSS 0.3%CVE-2025-69359MEDIUMWordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-40667HIGHMissing authorization vulnerability in TCMAN GIM v11EPSS 0.3%CVE-2026-1650MEDIUMMDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field DeletionEPSS 0.3%CVE-2025-53288MEDIUMWordPress PlatiOnline Payments plugin <= 7.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-47870HIGHWordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-66131MEDIUMWordPress Yaad Sarig Payment Gateway For WC plugin <= 2.2.11 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-69364MEDIUMWordPress Breeze plugin <= 2.2.21 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-13334HIGHBlaze Demo Importer 1.0.0 - 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Database Reset and File DeletionEPSS 0.3%CVE-2025-62122MEDIUMWordPress Trash Duplicate and 301 Redirect plugin <= 1.9.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-24095MEDIUMMissing Permission Check on Analyze Configuration PageEPSS 0.3%CVE-2025-53293MEDIUMWordPress Dashboard Widget Sidebar plugin <= 1.2.3 - Broken Access Control VulnerabilityEPSS 0.3%