Weaknesses of type CWE-862

8,451 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2020-36719CRITICALListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and DeactivationEPSS 4.3%CVE-2022-0236HIGHWP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data DisclosureEPSS 4.3%CVE-2024-43045MEDIUMJenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/EPSS 4.3%CVE-2022-1054—RSVP and Event Management < 2.7.8 - Unauthenticated Entries ExportEPSS 4.2%CVE-2024-4898CRITICALInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User CreationEPSS 4.2%CVE-2026-41266HIGHFlowise: Sensitive Data Leak in public-chatbotConfigEPSS 4.1%CVE-2019-18581CRITICALDell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a servEPSS 3.9%CVE-2025-10184HIGHOnePlus OxygenOS Telephony provider permission bypassEPSS 3.8%CVE-2022-23945—Apache ShenYu missing authentication allows gateway registrationEPSS 3.8%CVE-2023-22478HIGHKubePi is vulnerable to missing authorizationEPSS 3.6%CVE-2017-7548—PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privEPSS 3.5%CVE-2019-10184MEDIUMundertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted throEPSS 3.5%CVE-2024-45591MEDIUMXWiki Platform document history including authors of any page exposed to unauthorized actorsEPSS 3.4%CVE-2022-2379—Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST APIEPSS 3.4%CVE-2025-1562CRITICALRecover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin InstallationEPSS 3.3%CVE-2019-13547—Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use tEPSS 3.3%CVE-2025-45854CRITICAL/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.EPSS 3.2%CVE-2026-73296CRITICALMicrosoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosureEPSS 2.9%CVE-2022-48166HIGHAn access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log fEPSS 2.8%CVE-2021-24997—WP Guppy < 1.3 - Sensitive Information DisclosureEPSS 2.8%