Weaknesses of type CWE-862

9,223 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-77525MEDIUMMaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_idEPSS 0.2%CVE-2025-12665MEDIUMNinja Countdown <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown DeletionEPSS 0.2%CVE-2025-12113MEDIUMAlt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key DeletionEPSS 0.2%CVE-2025-11172MEDIUMCheck Plagiarism <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Settings UpdateEPSS 0.2%CVE-2026-0486MEDIUMMissing Authorization Check in ABAP based SAP systemsEPSS 0.2%CVE-2026-18709MEDIUMMissing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data InconsistencyEPSS 0.2%CVE-2026-103495MEDIUMIn JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogsEPSS 0.2%CVE-2026-23681MEDIUMMissing Authorization check in a function module in SAP Support Tools Plug-InEPSS 0.2%CVE-2025-43286HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26EPSS 0.2%CVE-2026-108496MEDIUMWordPress WP User Manager plugin <= 2.9.23 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-60166MEDIUMWordPress WP Subscription Forms PRO Plugin <= 2.0.5 - Arbitrary Content Deletion VulnerabilityEPSS 0.2%CVE-2025-64219MEDIUMWordPress Business Directory plugin <= 6.4.18 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-42851HIGH@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCEEPSS 0.2%CVE-2025-27432LOWMissing Authorization check in SAP Electronic Invoicing for Brazil (eDocument Cockpit)EPSS 0.2%CVE-2026-93620MEDIUMWordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-108867MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetByIdEPSS 0.2%CVE-2026-108659MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserIdEPSS 0.2%CVE-2023-43488HIGHThe vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to eEPSS 0.2%CVE-2026-108673MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXlsEPSS 0.2%CVE-2025-11762MEDIUMHubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin DisclosureEPSS 0.2%