Weaknesses of type CWE-862

9,106 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-12355MEDIUMPayaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status UpdateEPSS 0.2%CVE-2025-54714HIGHWordPress Zephyr Project Manager Plugin <= 3.3.201 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2026-24326MEDIUMMissing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations)EPSS 0.2%CVE-2024-34690MEDIUMMissing Authorization check in SAP Student Life Cycle Management (SLcM)EPSS 0.2%CVE-2026-24386MEDIUMWordPress Element Invader – Template Kits for Elementor plugin <= 1.2.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-18156MEDIUMIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2025-5185MEDIUMSummer Pearl Group Vacation Rental Management Platform cross-site request forgeryEPSS 0.2%CVE-2026-3351LOWAuthorization Bypass in LXD GET /1.0/certificates EndpointEPSS 0.2%CVE-2025-10173LOWShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings UpdateEPSS 0.2%CVE-2026-24636MEDIUMWordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-12515MEDIUMKatello: missing repository authorization in content_uploads exposes cross-product content existenceEPSS 0.2%CVE-2026-17618HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-24388MEDIUMWordPress WPMasterToolKit plugin <= 2.14.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-68556MEDIUMWordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-12953MEDIUMClassified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Listing Types TamperingEPSS 0.2%CVE-2026-1934MEDIUMMotors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' ParameterEPSS 0.2%CVE-2025-62079MEDIUMWordPress WP Export Categories & Taxonomies plugin <= 1.0.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-0929MEDIUMRegistrationMagic < 6.0.7.2 - Subscriber+ Form CreationEPSS 0.2%CVE-2026-85005MEDIUMPopup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing AuthorizationEPSS 0.2%CVE-2025-67579MEDIUMWordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerabilityEPSS 0.2%