Weaknesses of type CWE-862

9,009 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-57969MEDIUMWordPress Hide WP Toolbar Plugin <= 2.7 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2024-10390MEDIUMElfsight Telegram Chat CC <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-62928MEDIUMWordPress SEO Meta Description Updater plugin <= 1.2.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-34824MEDIUMWordPress SportsPress – Sports Club & League Manager plugin <= 2.7.20 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-24590MEDIUMWordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-58221MEDIUMWordPress PilotPress Plugin <= 2.0.36 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-62915MEDIUMWordPress SMS Contact Form 7 Notifications by ClickSend plugin <= 1.4.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-100596HIGHOpenClaw before 2026.7.1 Authorization Bypass via MCP ConfigurationEPSS 0.2%CVE-2026-61837MEDIUMRabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checksEPSS 0.2%CVE-2025-57972MEDIUMWordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-40098MEDIUMOpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variantEPSS 0.2%CVE-2025-59559MEDIUMWordPress Payrexx Payment Gateway for WooCommerce Plugin <= 3.1.5 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-57995MEDIUMWordPress DethemeKit For Elementor Plugin <= 2.1.10 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-14001MEDIUMWP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post DuplicationEPSS 0.2%CVE-2025-12449MEDIUMaBlocks – WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings ModificationEPSS 0.2%CVE-2026-62073HIGHWordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-96818HIGHWordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-59561MEDIUMWordPress Smart Blocks Plugin <= 2.4 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-66157MEDIUMWordPress Sliper for Elementor plugin <= 1.0.10 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66159MEDIUMWordPress Walker for Elementor plugin <= 1.1.6 - Broken Access Control vulnerabilityEPSS 0.2%