Weaknesses of type CWE-862

10,142 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-65675HIGHCoPilot Chat Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2025-68043HIGHWordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-75607HIGHFrigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only OperationsEPSS 0.6%CVE-2026-45260HIGHPimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handlingEPSS 0.6%CVE-2026-76319HIGHRemote Code Execution (RCE) through Federated Search in Splunk EnterpriseEPSS 0.6%CVE-2022-44009HIGHImproper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to aEPSS 0.6%CVE-2026-79748CRITICALMCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)EPSS 0.6%CVE-2023-41649MEDIUMWordPress Ovic Product Bundle plugin <= 1.1.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-43662MEDIUMAuthenticated arbitrary file upload to /tmp/ and /tmp/upload/EPSS 0.6%CVE-2026-62666HIGHGrav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of superEPSS 0.6%CVE-2023-48245MEDIUMThe vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) EPSS 0.6%CVE-2023-37869MEDIUMWordPress Premium Addons PRO plugin <= 2.9.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-90800HIGHApache CouchDB: Auth bypass in prefixed _users and _replicator databasesEPSS 0.6%CVE-2021-32504—Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious aEPSS 0.6%CVE-2020-9009LOWThe ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database (via actionEPSS 0.6%CVE-2026-70178HIGHMicrosoft Fabric Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2023-49167MEDIUMWordPress Database for CF7 plugin <= 1.2.4 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2021-4366MEDIUMPWA for WP & AMP < = 1.7.32 - Missing AuthorizationEPSS 0.6%CVE-2023-27310MEDIUMA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails EPSS 0.6%CVE-2023-39544—CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleEPSS 0.6%