Weaknesses of type CWE-862

9,009 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-5862MEDIUMMissing Authorization in hamza417/inureEPSS 0.3%CVE-2025-11373MEDIUMPopup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type UploadEPSS 0.3%CVE-2024-4744MEDIUMWordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-42373MEDIUMMissing Authorization Check in SAP Student Life Cycle Management (SLcM)EPSS 0.3%CVE-2026-49782MEDIUMWordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-68016MEDIUMWordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerabilityEPSS 0.3%CVE-2024-4422MEDIUMComparison Slider <= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-91160HIGHOpenWA: A read-only API key can receive a session pairing QR over the WebSocket event streamEPSS 0.3%CVE-2026-95296MEDIUMMissing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to oEPSS 0.3%CVE-2024-44112MEDIUMMissing Authorization check in SAP for Oil & Gas (Transportation and Distribution)EPSS 0.3%CVE-2023-48751MEDIUMWordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access ControlEPSS 0.3%CVE-2026-57297MEDIUMA missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read peEPSS 0.3%CVE-2026-57299MEDIUMMissing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permEPSS 0.3%CVE-2024-44116MEDIUMMultiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 0.3%CVE-2024-10663MEDIUMEleblog – Elementor Blog And Magazine Addons <= 1.8 - Missing Authorization to Authenticated (Subscriber+) Deactivation SubmissionEPSS 0.3%CVE-2025-12527MEDIUMPage & Post Notes <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/DeletionEPSS 0.3%CVE-2025-5885MEDIUMKonica Minolta bizhub cross-site request forgeryEPSS 0.3%CVE-2025-66104MEDIUMWordPress Offload, AI & Optimize with Cloudflare Images plugin <= 1.9.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-11773MEDIUMMasteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement ModificationEPSS 0.3%CVE-2024-44115MEDIUMMultiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 0.3%