Weaknesses of type CWE-862

8,916 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2021-4446MEDIUMEssential Addons for Elementor <= 4.6.4 - Missing AuthorizationEPSS 0.3%CVE-2026-1537MEDIUMLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details ExposureEPSS 0.3%CVE-2026-24575MEDIUMWordPress WishList Member X plugin <= 3.29.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-96680MEDIUMByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorizationEPSS 0.3%CVE-2025-26920MEDIUMWordPress Customify theme <= 0.4.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-12782MEDIUMBeaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status TamperingEPSS 0.3%CVE-2025-62017MEDIUMWordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-22287MEDIUMWordPress LTL Freight Quotes – FreightQuote Edition plugin <= 2.3.11 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-23190MEDIUMMissing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)EPSS 0.3%CVE-2025-49970MEDIUMWordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-53230HIGHWordPress Page Manager for Elementor Plugin <= 2.0.5 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-63077MEDIUMWordPress Happy Addons for Elementor plugin <= 3.20.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-102780MEDIUMJoomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4EPSS 0.3%CVE-2023-22836LOWIn cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default value, the renamed value may be visible to the rest of the stack’s tenants.EPSS 0.3%CVE-2026-105488HIGHMissing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vauEPSS 0.3%CVE-2025-49973MEDIUMWordPress Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes plugin <= 1.0.10 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-31603MEDIUMWordPress CF7 Spreadsheets plugin <= 2.3.2 - Settings Change vulnerabilityEPSS 0.3%CVE-2026-39401MEDIUMPrivilege Escalation via update_event Job Output in CronicleEPSS 0.3%CVE-2025-62916MEDIUMWordPress Flights & Hotels Booking WP Plugin plugin <= 3.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-13354MEDIUMTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term ManipulationEPSS 0.3%