Weaknesses of type CWE-862

9,039 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-47692MEDIUMWordPress ContentStudio plugin <= 1.3.5 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-54733MEDIUMWordPress All Bootstrap Blocks Plugin <= 1.3.28 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2026-86857HIGHAuthorization Bypass in ServiceNow AI PlatformEPSS 0.2%CVE-2026-24570MEDIUMWordPress Edwiser Bridge plugin <= 4.3.2 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-24551MEDIUMWordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-58978MEDIUMWordPress PDF Generator for WordPress Plugin <= 1.5.4 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-69300MEDIUMWordPress Premium Addons for Elementor plugin <= 4.11.63 - Settings Change vulnerabilityEPSS 0.2%CVE-2026-79042MEDIUMMissing authorization in Payments in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineerEPSS 0.2%CVE-2025-32236MEDIUMWordPress Woocommerce Products Reorder Drag Drop Multiple Sort plugin <= 1.9 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-87543MEDIUMMissing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to EPSS 0.2%CVE-2025-14003MEDIUMImage Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery ModificationEPSS 0.2%CVE-2026-24581MEDIUMWordPress Points and Rewards for WooCommerce plugin <= 2.9.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-62931MEDIUMWordPress MSN Partner Hub plugin <= 2.9 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-87557MEDIUMMissing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderEPSS 0.2%CVE-2026-65926LOWPrivate Release Bundle versions may be disclosed under specific configurationsEPSS 0.2%CVE-2025-64254LOWWordPress Photo Block plugin <= 1.5.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-0763MEDIUMUltimate Classified Listings <= 1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings UpdateEPSS 0.2%CVE-2025-64150MEDIUMA missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect tEPSS 0.2%CVE-2025-14540MEDIUMUserback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration ExposureEPSS 0.2%CVE-2025-14117MEDIUMfit2cloud Halo cross-site request forgeryEPSS 0.2%