Weaknesses of type CWE-862

8,919 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-66135MEDIUMWordPress Imager for Elementor plugin <= 2.0.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-24021MEDIUMiTop doesn't have mass assignment of fields in the portal formEPSS 0.3%CVE-2025-62106MEDIUMWordPress WP-CRM System plugin <= 3.4.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-65028MEDIUMRallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant VotesEPSS 0.3%CVE-2025-12042MEDIUMCourse Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data ExportEPSS 0.3%CVE-2025-39553MEDIUMWordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-50010MEDIUMWordPress Zapier for WordPress plugin <= 1.5.2 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-66139MEDIUMWordPress Audier For Elementor plugin <= 1.0.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-45284LOWMissing authorization check in SAP Student Life Cycle Management (SLcM)EPSS 0.3%CVE-2026-25420MEDIUMWordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-9820LOWMattermost schemes teams endpoint exposes private team invite IDsEPSS 0.3%CVE-2026-25399MEDIUMWordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-48337MEDIUMWordPress QuickCab plugin <= 1.3.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-84904LOWKing Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image OptimizerEPSS 0.3%CVE-2026-24586MEDIUMWordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-7133MEDIUMCodeAstro Online Movie Ticket Booking System cross-site request forgeryEPSS 0.3%CVE-2025-8482MEDIUMSimple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar MigrationEPSS 0.3%CVE-2026-87026LOWTanium addressed an improper access controls vulnerability in Threat Response.EPSS 0.3%CVE-2023-22674MEDIUMWordPress Dashicons + Custom Post Types Plugin <= 1.0.2 is vulnerable to Broken Access ControlEPSS 0.3%CVE-2026-95342MEDIUMMissing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTMLEPSS 0.3%