Weaknesses of type CWE-862

9,154 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-62099MEDIUMWordPress Signature Add-On for Gravity Forms plugin <= 1.8.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-105209CRITICALZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey EnrollmentEPSS 0.2%CVE-2026-71895HIGHApache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes CredentialsEPSS 0.2%CVE-2025-54045MEDIUMWordPress CM On Demand Search And Replace plugin <= 1.5.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64244MEDIUMWordPress Restrict Elementor Widgets, Columns and Sections plugin <= 1.12 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-7782HIGHWP JobHunt <= 7.7 - Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status'EPSS 0.2%CVE-2025-62995MEDIUMWordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.12 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64246MEDIUMWordPress Accessibility by AudioEye plugin <= 1.0.49 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64248MEDIUMWordPress Request a Quote plugin <= 2.5.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-62078MEDIUMWordPress Easy Upload Files During Checkout plugin <= 3.0.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-68588MEDIUMWordPress TS Poll plugin <= 2.5.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-95278HIGHMissing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer processEPSS 0.2%CVE-2025-13935MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course CompletionEPSS 0.2%CVE-2026-0687MEDIUMMeta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery ManagementEPSS 0.2%CVE-2025-68587MEDIUMWordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-106312MEDIUMMissing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain seEPSS 0.2%CVE-2025-10476MEDIUMWP Fastest Cache <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) DB Cleanup ActionsEPSS 0.2%CVE-2025-49880MEDIUMWordPress CubeWP Forms plugin <= 1.1.5 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-49857MEDIUMWordPress myCred plugin <= 2.9.4.2 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-13391MEDIUMProduct Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File DeletionEPSS 0.2%