Weaknesses of type CWE-862

9,062 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-8446MEDIUMBlaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin InstallEPSS 0.2%CVE-2024-13747MEDIUMWooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL InjectionEPSS 0.2%CVE-2024-13715MEDIUMzStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache ClearingEPSS 0.2%CVE-2025-68608HIGHWordPress Userpro plugin <= 5.1.9 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-12134MEDIUMZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/DisableEPSS 0.2%CVE-2026-19946MEDIUMAwesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' ParameterEPSS 0.2%CVE-2026-3829MEDIUMWP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup TamperingEPSS 0.2%CVE-2025-54710HIGHWordPress Tiktok Feed Plugin <= 1.0.21 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2026-19892HIGHInfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link DisclosureEPSS 0.2%CVE-2025-62869MEDIUMWordPress Gravitec.net – Web Push Notifications plugin <= 2.9.17 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-97898HIGHBroken authorization in Akia keyless entry lets an authenticated guest unlock other roomsEPSS 0.2%CVE-2026-101267LOWRevenue information leakEPSS 0.2%CVE-2025-62932MEDIUMWordPress Table Block by RioVizual plugin <= 3.0.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-32423MEDIUMWordPress Admin and Site Enhancements (ASE) plugin <= 8.4.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-62021MEDIUMWordPress Acknowledgify plugin <= 1.1.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-18179MEDIUMIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-40132MEDIUMMissing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)EPSS 0.2%CVE-2024-5768MEDIUMMIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-63038MEDIUMWordPress WP Custom Admin Interface plugin <= 7.40 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2020-10697—A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage EPSS 0.2%