Weaknesses of type CWE-862

9,218 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-106187MEDIUMMissing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer procEPSS 0.2%CVE-2025-66114MEDIUMWordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64259MEDIUMWordPress Theater for WordPress plugin <= 0.18.8 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-31813HIGHTOTOLINK EX200 V4.0.3c.7646_B20201211 does not contain an authentication mechanism by default.EPSS 0.2%CVE-2026-15247MEDIUMSearch Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/DeletionEPSS 0.2%CVE-2025-64382MEDIUMWordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64378HIGHWordPress ListingPro theme < 2.9.10 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-9549MEDIUMFacets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099EPSS 0.2%CVE-2026-18704HIGHImproper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write OperationsEPSS 0.2%CVE-2025-66089MEDIUMWordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66109MEDIUMWordPress Cart Weight for WooCommerce plugin <= 1.9.11 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66112MEDIUMWordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2023-42896MEDIUMAn issue was addressed with improved handling of temporary files. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17EPSS 0.2%CVE-2025-12937MEDIUMACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field UpdateEPSS 0.2%CVE-2026-100269MEDIUMIn JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassedEPSS 0.2%CVE-2025-66144MEDIUMWordPress Worker for Elementor plugin <= 1.0.10 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66149MEDIUMWordPress UnGrabber plugin <= 3.1.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-62108MEDIUMWordPress Add Custom Codes plugin <= 4.80 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-69341MEDIUMWordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-66150MEDIUMWordPress Appender plugin <= 1.1.1 - Broken Access Control vulnerabilityEPSS 0.2%