Weaknesses of type CWE-862

9,009 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-14978MEDIUMPeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing Authorization to Unauthenticated Order Status ModificationEPSS 0.2%CVE-2026-84907LOWEventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST EndpointEPSS 0.2%CVE-2025-31841MEDIUMWordPress FPW Category Thumbnails Plugin <= 1.9.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-13472MEDIUMMissing authorization in BlazeMeter Jenkins PluginEPSS 0.2%CVE-2025-1233MEDIUMLafka Plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option UpdateEPSS 0.2%CVE-2026-24577MEDIUMWordPress Pie Register plugin <= 3.8.4.8 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-1036MEDIUMPhoto Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment DeletionEPSS 0.2%CVE-2025-49221LOWUnauthenticated Access to Channel Subscription in Mattermost Confluence PluginEPSS 0.2%CVE-2025-15524MEDIUMGallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata ExposureEPSS 0.2%CVE-2025-68050MEDIUMWordPress Leadpages plugin <= 1.1.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-4746MEDIUMWordPress Netgsm plugin <= 2.9.32 - Broken Access Control + CSRF vulnerabilityEPSS 0.2%CVE-2025-67737LOWAzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCEEPSS 0.2%CVE-2023-7293MEDIUMPaytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_mollie_account_details'EPSS 0.2%CVE-2025-64142MEDIUMA missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect toEPSS 0.2%CVE-2024-33909MEDIUMWordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-16772HIGHCVE-2026-16772EPSS 0.2%CVE-2026-24945MEDIUMWordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-49872MEDIUMWordPress myCred plugin <= 2.9.4.2 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-30929MEDIUMWordPress fluXtore plugin <= 1.6.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-8778MEDIUMNitroPack <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax FunctionEPSS 0.2%