Weaknesses of type CWE-862

9,163 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-104390MEDIUMWordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-0836MEDIUMXProtect MIP API Missing AuthorizationEPSS 0.2%CVE-2026-108661HIGHJeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenantEPSS 0.2%CVE-2026-15947MEDIUMSearch Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' ParameterEPSS 0.2%CVE-2025-12167MEDIUMContact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log ResetEPSS 0.2%CVE-2026-24313MEDIUMMissing Authorization check in SAP Solution Tools Plug-In (ST-PI)EPSS 0.2%CVE-2025-69022MEDIUMWordPress HR Management Lite plugin <= 3.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-97267MEDIUMWordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-108883HIGHJeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfigEPSS 0.2%CVE-2026-91108MEDIUMAlt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX ActionEPSS 0.2%CVE-2026-103337MEDIUMWordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-2520MEDIUMOnline Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin UpdateEPSS 0.2%CVE-2025-54458MEDIUMUnauthorized Subscription Creation to Confluence Space in Mattermost Confluence PluginEPSS 0.2%CVE-2026-18132MEDIUMIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-95589MEDIUMWordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-95371MEDIUMMissing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer EPSS 0.2%CVE-2026-93529MEDIUMWordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-108877MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteEPSS 0.2%CVE-2026-24368MEDIUMWordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-24380MEDIUMWordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerabilityEPSS 0.2%