Weaknesses of type CWE-862

9,066 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-39376MEDIUMWordPress Car Park Booking System for WordPress plugin <= 2.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-39454MEDIUMWordPress Name Directory plugin <= 1.30.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-48268MEDIUMWordPress Bot for Telegram on WooCommerce plugin <= 1.2.6 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-48128MEDIUMWordPress Sharespine Woocommerce Connector plugin <= 4.7.55 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-39398MEDIUMWordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue theme <= 4.2.2 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-27435MEDIUMInformation Disclosure Vulnerability in SAP Commerce CloudEPSS 0.2%CVE-2025-3624MEDIUMMissing Authorization Vulnerability in Hitachi Ops Center AnalyzerEPSS 0.2%CVE-2023-52217MEDIUMWordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-68508MEDIUMWordPress Brave plugin <= 0.8.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-59353HIGHManager generates mTLS certificates for arbitrary IP addressesEPSS 0.2%CVE-2026-4309MEDIUMMissing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a specific device information and change thEPSS 0.2%CVE-2026-95285HIGHMissing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renEPSS 0.2%CVE-2026-18122MEDIUMConcrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing AuthorizationEPSS 0.2%CVE-2025-42960MEDIUMMissing Authorization Check in SAP Business Warehouse and SAP BW/4HANA BEx ToolsEPSS 0.2%CVE-2025-14038HIGHEDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an atEPSS 0.2%CVE-2025-48079MEDIUMWordPress ProfileGrid plugin <= 5.9.5.1 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2026-87748HIGHPrivilege Escalation via Account Takeover in Interprobe's Qorela DCEPSS 0.2%CVE-2026-108628HIGHJeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission EndpointEPSS 0.2%CVE-2025-62132MEDIUMWordPress Tasty Recipes Lite plugin <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-62973MEDIUMWordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerabilityEPSS 0.2%