Weaknesses of type CWE-862

9,062 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-96613HIGHMissing Authorization in Meari IoT Cloud Platform OpenAPI ServiceEPSS 0.2%CVE-2026-107395MEDIUMIndico: Missing access check in legacy session export APIEPSS 0.2%CVE-2025-14618MEDIUMSweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph DeletionEPSS 0.2%CVE-2025-13119MEDIUMFabian Ros/SourceCodester Simple E-Banking System cross-site request forgeryEPSS 0.2%CVE-2026-32388MEDIUMWordPress GLB theme <= 1.2.2 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-8595MEDIUMZakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo ImportEPSS 0.2%CVE-2025-12847MEDIUMAll in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media DeletionEPSS 0.2%CVE-2026-11446MEDIUMBooktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing AuthorizationEPSS 0.2%CVE-2026-32391MEDIUMWordPress SmartFix theme < 1.2.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-90952MEDIUMWP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST APIEPSS 0.2%CVE-2024-44156HIGHA path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS SequoiaEPSS 0.2%CVE-2025-14272HIGHRockwell Automation FactoryTalk Analytics PavilionXEPSS 0.2%CVE-2025-2276MEDIUMUltimate Dashboard <= 3.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules Activation/DeactivationEPSS 0.2%CVE-2026-90599MEDIUMRizwan17 inventory-management-system process.php cross-site request forgeryEPSS 0.2%CVE-2025-12498MEDIUMEventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note CreationEPSS 0.2%CVE-2026-32408MEDIUMWordPress Brizy plugin <= 2.7.23 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-53374LOWDokploy Improperly Discloses User Information via user.one EndpointEPSS 0.2%CVE-2025-68592MEDIUMWordPress WP Adminify plugin <= 4.0.6.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-24535MEDIUMWordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-71322MEDIUMLemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = FalseEPSS 0.2%