Weaknesses of type CWE-862

10,142 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-72709CRITICALSPIP < 4.4.18 Missing Authorization via ecrire/action/EPSS 0.7%CVE-2023-23975MEDIUMWordPress Quick Event Manager plugin <= 9.7.4 - Broken Access Control vulnerabilityEPSS 0.7%CVE-2021-4371MEDIUMWP Quick FrontEnd Editor <= 5.5 - Authenticated Settings ChangeEPSS 0.7%CVE-2026-70619HIGHOdysseus Missing Admin Authorization via Embedding Endpoint RoutesEPSS 0.7%CVE-2023-25454MEDIUMWordPress Protected Posts Logout Button plugin <= 1.4.5 - Broken Access Control vulnerabilityEPSS 0.7%CVE-2024-2882CRITICALMissing Authorization in SDG Technologies PnPSCADAEPSS 0.7%CVE-2025-3960MEDIUMwithstars Books-Management-System Background Interface allreaders.html authorizationEPSS 0.7%CVE-2026-90863CRITICALPrivilege Escalation via Missing Authorization in WS_FTP ManagerEPSS 0.7%CVE-2025-3963MEDIUMwithstars Books-Management-System Background Interface list authorizationEPSS 0.7%CVE-2022-36418MEDIUMWordPress HREFLANG Tags Lite Plugin <= 2.0.0 is vulnerable to Broken AuthenticationEPSS 0.7%CVE-2025-10706HIGHClassified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin InstallationEPSS 0.7%CVE-2025-10896HIGHMultiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin UploadEPSS 0.7%CVE-2021-4348HIGHUltimate GDPR & CCPA <= 2.4 - Unauthenticated Settings Import & ExportEPSS 0.7%CVE-2022-41252MEDIUMMissing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allows users with Overall/Read permission to enumerate credentials ID EPSS 0.7%CVE-2026-92762HIGHPelican Panel before 1.0.0-beta35 Authorization Bypass via StartupEPSS 0.7%CVE-2023-26269HIGHApache James server: Privilege escalation through unauthenticated JMXEPSS 0.7%CVE-2021-4347CRITICALAdvanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options ChangeEPSS 0.7%CVE-2023-22708MEDIUMWordPress Kraken.io Image Optimizer plugin <= 2.6.7 - Broken Access Control vulnerabilityEPSS 0.7%CVE-2022-41251MEDIUMA missing permission check in Jenkins Apprenda Plugin 2.2.0 and earlier allows users with Overall/Read permission to enumerate credentials IEPSS 0.7%CVE-2025-5894HIGHHonding Technology Smart Parking Management System - Missing AuthorizationEPSS 0.7%