Weaknesses of type CWE-862

9,000 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-0122HIGHNVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. EPSS 0.3%CVE-2025-69297HIGHWordPress Aardvark Plugin plugin <= 2.19 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-13309MEDIUMAccessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters <= 1.0.2 - Authenticated (Subscriber+) Missing Authorization to Modify Accessibility SettingsEPSS 0.3%CVE-2026-32451MEDIUMWordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-54025MEDIUMWordPress Coupon Affiliates Plugin <= 6.4.0 - Settings Change VulnerabilityEPSS 0.3%CVE-2026-65938MEDIUMWhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.EPSS 0.3%CVE-2024-40834MEDIUMThis issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, mEPSS 0.3%CVE-2023-23729MEDIUMWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Contributor+ reCAPTCHA Settings Change VulnerabilityEPSS 0.3%CVE-2025-69298HIGHWordPress Gauge theme <= 6.56.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-49949MEDIUMWordPress Templazee plugin <= 1.0.2 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-14581MEDIUMHAPPY – Helpdesk Support Ticket System <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket ReplyEPSS 0.3%CVE-2025-15405MEDIUMPHPEMS cross-site request forgeryEPSS 0.3%CVE-2025-9979MEDIUMMaspik <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log ExportEPSS 0.3%CVE-2025-62090MEDIUMWordPress Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons plugin <= 3.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-30990MEDIUMWordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-22721MEDIUMWordPress ApplyOnline plugin <= 2.6.7.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-13558MEDIUMBlog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post TrashingEPSS 0.3%CVE-2026-105848MEDIUMPayload: Insufficient Access Control in Stripe REST ProxyEPSS 0.3%CVE-2025-23955MEDIUMWordPress Xola plugin <= 1.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-14446MEDIUMPopup Builder <= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings ResetEPSS 0.3%