Weaknesses of type CWE-862

9,036 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-58337HIGHAkuvox Smart Intercom S539 Improper Access Control via ServicesHTTPAPIEPSS 0.2%CVE-2025-65020MEDIUMRallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)EPSS 0.2%CVE-2026-84328LOWMissing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2026-1787MEDIUMLearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course DeletionEPSS 0.2%CVE-2026-16750MEDIUMMotors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings ExposureEPSS 0.2%CVE-2025-26656MEDIUMMissing Authorization check in S/4HANA (Manage Purchasing Info Records)EPSS 0.2%CVE-2024-13335MEDIUMSastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme InstallEPSS 0.2%CVE-2025-23188MEDIUMMissing Authorization check in SAP S/4HANA (RBD)EPSS 0.2%CVE-2025-15289LOWTanium addressed an improper access controls vulnerability in Interact.EPSS 0.2%CVE-2024-32656HIGHAnt Media Server vulnerable to local privilege escalationEPSS 0.2%CVE-2026-87498LOWMissing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process toEPSS 0.2%CVE-2025-23189MEDIUMMissing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)EPSS 0.2%CVE-2026-87434LOWMissing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to EPSS 0.2%CVE-2025-69012MEDIUMWordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-101063MEDIUMObot before v0.23.0 Authentication Bypass via Registry APIEPSS 0.2%CVE-2023-25445MEDIUMWordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64254LOWWordPress Photo Block plugin <= 1.5.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-14540MEDIUMUserback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration ExposureEPSS 0.2%CVE-2025-68585LOWWordPress WP Document Revisions plugin <= 3.7.2 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-24610MEDIUMWordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerabilityEPSS 0.2%