Weaknesses of type CWE-862

8,497 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-30772HIGHWordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 0.6%CVE-2023-33324MEDIUMWordPress Easy Captcha plugin <= 1.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2022-44009HIGHImproper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to aEPSS 0.6%CVE-2026-31309CRITICALImproper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated atEPSS 0.6%CVE-2025-22612CRITICALCoolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)EPSS 0.6%CVE-2026-65667CRITICALMicrosoft Teams Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-4888MEDIUMArbitrary File Deletion in BerriAI/litellmEPSS 0.6%CVE-2023-24431MEDIUMA missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate EPSS 0.6%CVE-2025-32253MEDIUMWordPress Course Booking System Plugin <= 6.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-7031HIGHFile Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings UpdateEPSS 0.6%CVE-2022-0756MEDIUMMissing Authorization in salesagility/suitecrmEPSS 0.6%CVE-2025-2025MEDIUMGive <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings FunctionEPSS 0.6%CVE-2024-1229MEDIUMSimpleShop <= 2.10.2 - Missing AuthorizationEPSS 0.6%CVE-2023-39920HIGHWordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-43253MEDIUMWordPress Smart Online Order for Clover plugin <= 1.5.6 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-0974HIGHOrderable <= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin InstallationEPSS 0.6%CVE-2023-50903MEDIUMWordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2022-41230MEDIUMJenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReaEPSS 0.6%CVE-2022-41233MEDIUMJenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers wiEPSS 0.6%CVE-2026-6627HIGHWPFormify <= 1.1.1 - Missing AuthorizationEPSS 0.6%