Weaknesses of type CWE-862

9,069 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-79053LOWMissing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2025-12519MEDIUMInformation disclosure on Administration parameters API endpointEPSS 0.2%CVE-2025-62973MEDIUMWordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-108677HIGHJeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByNameEPSS 0.2%CVE-2026-24592MEDIUMWordPress Auto Affiliate Links plugin <= 6.8.8.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-62132MEDIUMWordPress Tasty Recipes Lite plugin <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-108657HIGHJeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApplyEPSS 0.2%CVE-2025-58980MEDIUMWordPress Export WP Page to Static HTML/CSS Plugin <= 4.1.0 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2026-14941MEDIUMCustomer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX ActionsEPSS 0.2%CVE-2025-14487MEDIUMHandily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' ParameterEPSS 0.2%CVE-2026-8194MEDIUMosTicket Dispatcher class.dispatcher.php cross-site request forgeryEPSS 0.2%CVE-2026-2518MEDIUMFastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and ActivationEPSS 0.2%CVE-2026-77391MEDIUMSourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgeryEPSS 0.2%CVE-2026-81279MEDIUMWordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64294MEDIUMWordPress WP Snow Effect plugin <= 1.1.19 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-39607MEDIUMWordPress Filter Plus plugin <= 1.1.17 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-12689MEDIUMProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing AuthorizationEPSS 0.2%CVE-2026-66589MEDIUMWordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2022-45813MEDIUMWordPress Advanced AJAX Product Filters plugin <= 1.6.3.3 - Broken Access Control + CSRFEPSS 0.2%CVE-2026-77517MEDIUMMaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge baseEPSS 0.2%