Weaknesses of type CWE-862

8,497 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-14357HIGHDevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' ParameterEPSS 0.6%CVE-2026-73653CRITICALVitest: Browser Mode provider commands bypass the file-access permission gateEPSS 0.6%CVE-2026-3640MEDIUMSTRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API EndpointEPSS 0.6%CVE-2026-58279MEDIUMAzure CycleCloud Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-40189CRITICALgoshs has a file-based ACL authorization bypass in goshs state-changing routesEPSS 0.6%CVE-2023-47458CRITICALAn issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework.EPSS 0.6%CVE-2023-32293MEDIUMWordPress WRC Pricing Tables plugin <= 2.3.7 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-5054MEDIUMSuper Store Finder <= 6.9.3 - Unauthenticated Email Creation/SendingEPSS 0.6%CVE-2025-34171MEDIUMCasaOS <= 0.4.15 Unauthenticated File and Debug Data ExposureEPSS 0.6%CVE-2024-13643HIGHZox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options ModificationEPSS 0.6%CVE-2023-41649MEDIUMWordPress Ovic Product Bundle plugin <= 1.1.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2025-10706HIGHClassified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin InstallationEPSS 0.6%CVE-2023-49154MEDIUMWordPress Button Generator – easily Button Builder plugin <= 2.3.8 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2025-24245CRITICALThis issue was addressed by adding a delay between verification code attempts. This issue is fixed in macOS Sequoia 15.4. A malicious app maEPSS 0.6%CVE-2023-2351MEDIUMWP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_actionEPSS 0.6%CVE-2026-8237MEDIUMConcrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpointEPSS 0.6%CVE-2023-50373MEDIUMWordPress Alt Manager plugin <= 1.6.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-22697MEDIUMWordPress Survey Maker plugin <= 3.2.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-40005MEDIUMWordPress Easy Digital Downloads plugin <= 3.1.5 - Broken Access ControlEPSS 0.6%CVE-2024-49367MEDIUMNginx UI's log path can be controlledEPSS 0.6%