Weaknesses of type CWE-862

8,915 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-82660MEDIUMNodemailer jsonTransport bypasses disableFileAccess and disableUrlAccessEPSS 0.3%CVE-2026-42776MEDIUMWordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-27091MEDIUMWordPress UiPress lite plugin <= 3.5.09 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-64384MEDIUMWordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57327MEDIUMWordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-9076MEDIUMMattermost Server exposes sensitive user credentials during shared channel membership synchronizationEPSS 0.3%CVE-2026-27150LOWDiscourse doesn't ensure guardian check when creating QueryGroupBookmarkEPSS 0.3%CVE-2025-14064MEDIUMBuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and ManipulationEPSS 0.3%CVE-2025-53318MEDIUMWordPress WP DB Booster plugin <= 1.0.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-66689MEDIUMWordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-18115HIGHIn Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.EPSS 0.3%CVE-2025-43007MEDIUMMissing Authorization check in SAP Service Parts Management (SPM)EPSS 0.3%CVE-2026-18346MEDIUMTikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' ParameterEPSS 0.3%CVE-2026-81788MEDIUMWordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-6341MEDIUMcode-projects School Fees Payment System cross-site request forgeryEPSS 0.3%CVE-2026-27331MEDIUMWordPress WpTravelly plugin <= 2.1.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57703MEDIUMWordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-63248MEDIUMIn Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can eEPSS 0.3%CVE-2025-63077MEDIUMWordPress Happy Addons for Elementor plugin <= 3.20.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-13354MEDIUMTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term ManipulationEPSS 0.3%