Weaknesses of type CWE-862

9,009 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-105848MEDIUMPayload: Insufficient Access Control in Stripe REST ProxyEPSS 0.3%CVE-2024-47055MEDIUMSegment cloning doesn't have a proper permission checkEPSS 0.3%CVE-2025-22721MEDIUMWordPress ApplyOnline plugin <= 2.6.7.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-27673MEDIUMMissing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise)EPSS 0.3%CVE-2025-62090MEDIUMWordPress Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons plugin <= 3.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-23929MEDIUMWordPress Email Capture & Lead Generation Plugin <= 1.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-23930MEDIUMWordPress PayPal Marketing Solutions plugin <= 1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-16187MEDIUMIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesEPSS 0.3%CVE-2025-54751HIGHWordPress PostX plugin <= 4.1.36 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-48127MEDIUMWordPress Push notification for Mobile and Web app plugin <= 2.0.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-58258MEDIUMWordPress Lazy Blocks Plugin <= 4.1.0 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-46488HIGHWordPress Visual Builder plugin <= 1.2.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-106196HIGHMissing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy EPSS 0.3%CVE-2024-55070LOWA Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers toEPSS 0.3%CVE-2024-4745MEDIUMWordPress Giveaways and Contests by RafflePress plugin <= 1.12.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-8860MEDIUMTourfic <= 2.14.5 - Missing Authorization in Multiple FunctionsEPSS 0.3%CVE-2025-5692MEDIUMLead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many ActionsEPSS 0.3%CVE-2025-50039MEDIUMWordPress VG WORT METIS plugin <= 2.0.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2023-5862MEDIUMMissing Authorization in hamza417/inureEPSS 0.3%CVE-2025-62883MEDIUMWordPress Premmerce User Roles plugin <= 1.0.13 - Broken Access Control vulnerabilityEPSS 0.3%