Weaknesses of type CWE-862

9,062 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-66063MEDIUMWordPress WP Google Review Slider plugin <= 17.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-8739MEDIUMzhenfeng13 My-Blog save cross-site request forgeryEPSS 0.2%CVE-2026-23974MEDIUMWordPress Golo theme < 1.7.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-67344HIGHArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPEEPSS 0.2%CVE-2025-54037MEDIUMWordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-53236MEDIUMWordPress UDesign Core plugin <= 4.14.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-58594MEDIUMWordPress Brizy Plugin <= 2.7.12 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-49377MEDIUMWordPress Hydra Booking plugin <= 1.1.9 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-3997MEDIUMdazhouda lecms Personal Information Page index.php cross-site request forgeryEPSS 0.2%CVE-2025-58599MEDIUMWordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2026-1148MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System cross-site request forgeryEPSS 0.2%CVE-2025-12350MEDIUMDominoKit <= 1.1.0 - Missing Authorization to Unauthenticated Settings UpdateEPSS 0.2%CVE-2024-13810MEDIUMZass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo ImportEPSS 0.2%CVE-2025-0515MEDIUMBuzz Club – Night Club, DJ and Music Festival Event WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option UpdateEPSS 0.2%CVE-2026-24387MEDIUMWordPress WP Quick Post Duplicator plugin <= 2.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-69381HIGHWordPress WooCommerce Bulk Product Editor plugin <= 3.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-13811MEDIUMLafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo ImportEPSS 0.2%CVE-2025-11692MEDIUMZip Attachments <= 1.6 - Missing Authorization to Limited File DeletionEPSS 0.2%CVE-2025-7821MEDIUMWC Plus <= 1.2.0 - Missing Authorization to Unauthenticated Settings ManipulationEPSS 0.2%CVE-2024-37202MEDIUMWordPress Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter plugin <= 1.222.17 - Broken Access Control to XSS vulnerabilityEPSS 0.2%