Weaknesses of type CWE-862

9,107 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-48339MEDIUMWordPress Profiler - What Slowing Down Your WP <= 1.0.0 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2026-25311MEDIUMWordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-1934MEDIUMMotors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' ParameterEPSS 0.2%CVE-2025-67579MEDIUMWordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-2312MEDIUMMedia Library Folders <= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and RenameEPSS 0.2%CVE-2026-85005MEDIUMPopup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing AuthorizationEPSS 0.2%CVE-2026-87611LOWMissing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2025-13179MEDIUMBdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System cross-site request forgeryEPSS 0.2%CVE-2025-26655LOWMissing Authorization check in SAP JIT(Outbound)EPSS 0.2%CVE-2025-68556MEDIUMWordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-59576MEDIUMWordPress MasterStudy LMS Plugin <= 3.6.20 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-12953MEDIUMClassified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Listing Types TamperingEPSS 0.2%CVE-2026-25391MEDIUMWordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-58639MEDIUMWordPress Contact Form By Mega Forms Plugin <= 1.6.1 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2026-24190HIGHNVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause improper access to GEPSS 0.2%CVE-2025-54717MEDIUMWordPress WP Membership Plugin <= 1.6.3 - Settings Change VulnerabilityEPSS 0.2%CVE-2025-1778MEDIUMArt Theme <= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option DeleteEPSS 0.2%CVE-2026-15760MEDIUMDivi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX ActionEPSS 0.2%CVE-2025-1358MEDIUMPix Software Vivaz cross-site request forgeryEPSS 0.2%CVE-2026-105306MEDIUMKeycloak-services: keycloak-services: token introspection audience bypass via dynamic client registrationEPSS 0.2%