Weaknesses of type CWE-862

10,142 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2022-45840MEDIUMWordPress Auto Affiliate Links plugin <= 6.2.1.5 - Unauth. Broken Access Control vulnerabilityEPSS 0.7%CVE-2025-24245CRITICALThis issue was addressed by adding a delay between verification code attempts. This issue is fixed in macOS Sequoia 15.4. A malicious app maEPSS 0.7%CVE-2023-35149MEDIUMA missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permissiEPSS 0.7%CVE-2023-2434LOWNested Pages <= 3.2.3 - Missing Authorization to Authenticated (Editor+) Plugin Settings ResetEPSS 0.7%CVE-2024-53591CRITICALAn issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack.EPSS 0.7%CVE-2026-70636HIGHFlowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh EndpointEPSS 0.7%CVE-2026-69197HIGHUmbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansionEPSS 0.7%CVE-2023-2268HIGHPlane v0.7.1 - Unauthorized access to filesEPSS 0.7%CVE-2025-53640MEDIUMIndico vulnerable to user enumeration via API endpointEPSS 0.7%CVE-2025-24580MEDIUMWordPress 12 Step Meeting List plugin <= 3.16.5 - Arbitrary Content Deletion vulnerabilityEPSS 0.7%CVE-2026-5581CRITICALMulti Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media DeletionEPSS 0.7%CVE-2022-0755HIGHMissing Authorization in salesagility/suitecrmEPSS 0.7%CVE-2022-41250MEDIUMA missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an aEPSS 0.7%CVE-2026-44914HIGHApache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow ContentsEPSS 0.7%CVE-2022-0179MEDIUMMissing Authorization in snipe/snipe-itEPSS 0.7%CVE-2026-15291HIGHChat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information ExposureEPSS 0.7%CVE-2022-40316MEDIUMThe H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers abEPSS 0.7%CVE-2026-6627HIGHWPFormify <= 1.1.1 - Missing AuthorizationEPSS 0.7%CVE-2023-38508MEDIUMTuleap allows preview of a linked artifact with a type does not respect permissionsEPSS 0.7%CVE-2021-4371MEDIUMWP Quick FrontEnd Editor <= 5.5 - Authenticated Settings ChangeEPSS 0.7%