Weaknesses of type CWE-862

8,916 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-46519MEDIUMWordPress Media Library Downloader plugin <= 1.3.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-50025MEDIUMMousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie stateEPSS 0.3%CVE-2025-5813MEDIUMAmazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product CreationEPSS 0.3%CVE-2025-12469MEDIUMFunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email SendingEPSS 0.3%CVE-2025-13404MEDIUMatec Duplicate Page & Post <= 1.2.20 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication and Data ExposureEPSS 0.3%CVE-2026-25323MEDIUMWordPress OSM plugin <= 6.1.12 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-24540MEDIUMWordPress Integrate Google Drive plugin <= 1.5.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-43228MEDIUMWordPress SecuPress Free plugin <= 2.2.5.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-6831MEDIUMAdvanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' ShortcodeEPSS 0.3%CVE-2025-13741MEDIUMSchedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails ExposureEPSS 0.3%CVE-2023-20064MEDIUMCisco IOS XR Software Bootloader Unauthenticated Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-25395MEDIUMWordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-5814MEDIUMProfiler – What Slowing Down Your WP <= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State RestorationEPSS 0.3%CVE-2025-62019MEDIUMWordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-21865MEDIUMDiscourse topic conversion permission vulnerability for moderatorsEPSS 0.3%CVE-2026-32461MEDIUMWordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-0954MEDIUMWP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings ImportEPSS 0.3%CVE-2025-1528MEDIUMSearch and filter pro <= 2.5.19 - Missing Authorization to Authenticated (Subscriber+) Post Meta ExposureEPSS 0.3%CVE-2025-6726MEDIUMBlock Editor Gallery Slider <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta UpdateEPSS 0.3%CVE-2026-59690HIGHProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST APIEPSS 0.3%