Weaknesses of type CWE-862

8,394 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-58168HIGHDeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin UsersEPSS 0.6%CVE-2024-1387MEDIUMHappy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information ExposureEPSS 0.6%CVE-2023-0555HIGHQuick Restaurant Menu <= 2.0.2 - Missing AuthorizationEPSS 0.6%CVE-2026-43639HIGHBitwarden Server < 2026.4.0 Missing Authorization via Provider ClientsEPSS 0.6%CVE-2022-46850HIGHWordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File DeletionEPSS 0.6%CVE-2023-34234MEDIUMGovernor proposal creation may be blocked by frontrunning in OpenZeppelinEPSS 0.6%CVE-2023-2189MEDIUMElementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Missing Authorization in toggle_widgetEPSS 0.6%CVE-2023-38385HIGHWordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-33137CRITICALXWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}EPSS 0.6%CVE-2025-27428HIGHDirectory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)EPSS 0.6%CVE-2023-34381MEDIUMWordPress Zippy plugin <= 1.6.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-0907MEDIUMNEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()EPSS 0.6%CVE-2024-1129MEDIUMNEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()EPSS 0.6%CVE-2024-1130MEDIUMNEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()EPSS 0.6%CVE-2026-59708HIGHGhostfolio - Unauthorized Portfolio Data Exposure via Public EndpointEPSS 0.6%CVE-2023-35875MEDIUMWordPress Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.8.5 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-25457MEDIUMWordPress Slider Carousel – Responsive Image Slider plugin <=1.5.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-51359MEDIUMWordPress Essential Blocks plugin <= 4.2.0 - Multiple Contributor+ Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-7648MEDIUMOpal Membership <= 1.2.4 - Authenticated (Subscriber+) Information DisclosureEPSS 0.6%CVE-2022-43417MEDIUMJenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/ReadEPSS 0.6%