Weaknesses of type CWE-862

9,099 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-64192MEDIUMWordPress XStore theme < 9.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-4971MEDIUMSourceCodester Note Taking App cross-site request forgeryEPSS 0.2%CVE-2026-102915HIGHWordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-97309HIGHWordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2025-12372MEDIUMThe Permalinks Cascade <= 2.2 - Missing Authorization To Authenticated (Subscriber+) Plugin Settings UpdateEPSS 0.2%CVE-2025-68045HIGHWordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-12133MEDIUMEPROLO Dropshipping <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Tracking Data ModificationEPSS 0.2%CVE-2025-12354MEDIUMLive CSS Preview <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings UpdateEPSS 0.2%CVE-2025-24116MEDIUMAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS VeEPSS 0.2%CVE-2026-72918MEDIUMRocket.Chat: Insecure implementation of websocket notificationsEPSS 0.2%CVE-2026-7108MEDIUMcode-projects Invoice System in Laravel cross-site request forgeryEPSS 0.2%CVE-2025-69315MEDIUMWordPress Simply Schedule Appointments plugin <= 1.6.9.15 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-12961MEDIUMDownload Panel <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings ModificationEPSS 0.2%CVE-2026-6589MEDIUMComfyUI server.py create_origin_only_middleware cross-site request forgeryEPSS 0.2%CVE-2026-25372MEDIUMWordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-67589MEDIUMWordPress WooCommerce PDF Invoices & Packing Slips plugin <= 4.9.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-4968MEDIUMSourceCodester Diary App diary.php cross-site request forgeryEPSS 0.2%CVE-2026-2284MEDIUMNews Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data LossEPSS 0.2%CVE-2025-11773MEDIUMCryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authorization to Authenticated (Subscriber+) Contract Address UpdateEPSS 0.2%CVE-2026-106388MEDIUMMissing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proEPSS 0.2%