Weaknesses of type CWE-862

10,142 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-2848HIGHResponsive <= 5.0.2 - Missing Authorization to HTML InjectionEPSS 0.7%CVE-2023-23834MEDIUMWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Activate_Plugin vulnerabilityEPSS 0.7%CVE-2021-25084—Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/DeletionEPSS 0.7%CVE-2023-4124HIGHMissing Authorization in answerdev/answerEPSS 0.7%CVE-2023-25966MEDIUMWordPress FileBird plugin <= 5.1.4 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-38002CRITICALThe workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, EPSS 0.6%CVE-2026-57579HIGHAlchemy: Unauthenticated nested page API leaks restricted & unpublished contentEPSS 0.6%CVE-2026-55178HIGHGeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile dataEPSS 0.6%CVE-2023-4686MEDIUMWP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information ExposureEPSS 0.6%CVE-2024-10575CRITICALCWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impactiEPSS 0.6%CVE-2025-1214MEDIUMpihome-shc PiHome Role-Based Access Control user_accounts.php authorizationEPSS 0.6%CVE-2021-24500—Workreap theme < 2.2.2 - Multiple CSRF + IDOR VulnerabilitiesEPSS 0.6%CVE-2024-21215HIGHVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areEPSS 0.6%CVE-2025-30772HIGHWordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 0.6%CVE-2026-3640MEDIUMSTRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API EndpointEPSS 0.6%CVE-2026-110617MEDIUMwe-mp-rss through 1.5.3 Missing Authorization via Export File Download EndpointEPSS 0.6%CVE-2026-58279MEDIUMAzure CycleCloud Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-62915MEDIUMMicrosoft Exchange Server Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2023-32293MEDIUMWordPress WRC Pricing Tables plugin <= 2.3.7 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-47458CRITICALAn issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework.EPSS 0.6%