Weaknesses of type CWE-862

8,497 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-54402MEDIUMWordPress Arabic Webfonts plugin <= 1.4.6 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-6088MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration BypassEPSS 0.6%CVE-2026-3360HIGHTutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' ParameterEPSS 0.6%CVE-2023-41130HIGHWordPress Premmerce User Roles plugin <= 1.0.12 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-1868MEDIUMYourChannel <= 1.2.3 - Missing Authorization to Plugin Cache ResetEPSS 0.6%CVE-2021-33704MEDIUMThe Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be EPSS 0.6%CVE-2026-48127MEDIUMFrappe: Arbitrary Attachment Injection via add_attachments and upload_fileEPSS 0.6%CVE-2024-3607MEDIUMPropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post DeletionEPSS 0.6%CVE-2023-35049HIGHWordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.6%CVE-2021-32504—Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious aEPSS 0.6%CVE-2024-3750HIGHVisualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL ExecutionEPSS 0.6%CVE-2025-12825MEDIUMUser Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information ExposureEPSS 0.6%CVE-2026-9178HIGHWP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST EndpointEPSS 0.6%CVE-2024-11334MEDIUMMy Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV ExportEPSS 0.6%CVE-2025-10896HIGHMultiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin UploadEPSS 0.6%CVE-2024-38002CRITICALThe workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, EPSS 0.6%CVE-2026-55638HIGH9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypassEPSS 0.6%CVE-2023-27701HIGHMuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /database/sqldel.html.EPSS 0.6%CVE-2023-47148MEDIUMIBM Storage Protect Plus Server information disclosureEPSS 0.6%CVE-2023-4637MEDIUMWPvivid <= 0.9.94 - Missing AuthorizationEPSS 0.6%