Weaknesses of type CWE-862

9,222 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-25393MEDIUMWordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-87979MEDIUMPaymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via WebhookEPSS 0.2%CVE-2026-25314MEDIUMWordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-25394MEDIUMWordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-8285MEDIUMUnauthorized Channel Subscription Creation in Mattermost Confluence PluginEPSS 0.2%CVE-2026-25308MEDIUMWordPress Simple Membership plugin <= 4.6.9 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-25330MEDIUMWordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-14103MEDIUMMissing Authorization in GitLabEPSS 0.2%CVE-2026-58482MEDIUMNetwork-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actionsEPSS 0.2%CVE-2025-9542MEDIUMAutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple FunctionsEPSS 0.2%CVE-2026-24990MEDIUMWordPress WP Docs plugin <= 2.2.8 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-12174MEDIUMDirectorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug UpdateEPSS 0.2%CVE-2026-25313MEDIUMWordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-2278MEDIUMVW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings ResetEPSS 0.2%CVE-2025-64215MEDIUMWordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-13419MEDIUMSmart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-64263MEDIUMWordPress WP Content Pilot plugin <= 2.1.7 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-68928HIGHAcode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as AcodeEPSS 0.2%CVE-2025-62072MEDIUMWordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-62965MEDIUMWordPress Admin Management Xtended plugin <= 2.5.1 - Broken Access Control vulnerabilityEPSS 0.2%