Weaknesses of type CWE-862

10,142 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-57578CRITICALDotVVM: Missing authorization in AuthorizeActionFilterEPSS 0.6%CVE-2024-2035MEDIUMImproper Authorization in zenml-io/zenmlEPSS 0.6%CVE-2026-43643HIGHSoftaculous Virtualizor Authorization Bypass via Billing Module HandlerEPSS 0.6%CVE-2026-123655HIGHMoodle: missing access checks on h5p content filesEPSS 0.6%CVE-2024-3897MEDIUMPopup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information ExposureEPSS 0.6%CVE-2025-12825MEDIUMUser Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information ExposureEPSS 0.6%CVE-2023-33324MEDIUMWordPress Easy Captcha plugin <= 1.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2022-41230MEDIUMJenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReaEPSS 0.6%CVE-2022-41233MEDIUMJenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers wiEPSS 0.6%CVE-2026-75030CRITICALApache Syncope: Incomplete authorization checks for Group members deprovisioningEPSS 0.6%CVE-2026-92763HIGHRundeck through 6.2.1 Authorization Bypass via Project ImportEPSS 0.6%CVE-2026-31309CRITICALImproper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated atEPSS 0.6%CVE-2024-4888MEDIUMArbitrary File Deletion in BerriAI/litellmEPSS 0.6%CVE-2022-0756MEDIUMMissing Authorization in salesagility/suitecrmEPSS 0.6%CVE-2024-7031HIGHFile Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings UpdateEPSS 0.6%CVE-2026-4431CRITICALEasy Post Submission <= 2.3.0 - Missing AuthorizationEPSS 0.6%CVE-2025-27666CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Authorization Checks OEPSS 0.6%CVE-2024-1229MEDIUMSimpleShop <= 2.10.2 - Missing AuthorizationEPSS 0.6%CVE-2026-25038HIGHGitea private organization labels are visible to unauthorized usersEPSS 0.6%CVE-2025-27428HIGHDirectory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)EPSS 0.6%