Weaknesses of type CWE-862

8,904 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-87493MEDIUMMissing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypasEPSS 0.3%CVE-2025-64277MEDIUMWordPress ChatBot plugin <= 7.3.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-69364MEDIUMWordPress Breeze plugin <= 2.2.21 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-10536MEDIUMFancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode ExportEPSS 0.3%CVE-2026-1650MEDIUMMDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field DeletionEPSS 0.3%CVE-2025-53200MEDIUMWordPress ChatBot plugin <= 6.7.3 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-9637MEDIUMQuiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response UploadsEPSS 0.3%CVE-2025-27461HIGHCVE-2025-27461EPSS 0.3%CVE-2025-60103MEDIUMWordPress ListingPro plugin <= 2.9.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57375MEDIUMWordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-61604CRITICALixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypassEPSS 0.3%CVE-2026-42640MEDIUMWordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-65499MEDIUMWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-40743MEDIUMWordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-66464MEDIUMWordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-59523MEDIUMWordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-73348MEDIUMWordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-33177MEDIUMStatamic is missing authorization check on taxonomy term creation via fieldtypeEPSS 0.3%CVE-2025-58672MEDIUMWordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-62925MEDIUMWordPress Conversios.io plugin <= 7.2.13 - Broken Access Control vulnerabilityEPSS 0.3%