Weaknesses of type CWE-862

9,235 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-108659MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserIdEPSS 0.2%CVE-2026-108669MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/searchEPSS 0.2%CVE-2025-64269MEDIUMWordPress WooCommerce PDF Invoice Builder plugin <= 1.2.150 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-109629MEDIUMFrappe ERPNext before 15.121.3 Missing Authorization in Transactional Email EndpointEPSS 0.2%CVE-2024-24709MEDIUMWordPress Shareaholic plugin <= 9.7.11 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-109611MEDIUMFrappe ERPNext before 15.121.0 Missing Authorization in Certain EndpointsEPSS 0.2%CVE-2026-109599MEDIUMFrappe before 15.113.3 Missing Authorization Allows Unauthorized Record ModificationEPSS 0.2%CVE-2026-25011MEDIUMWordPress WP Custom Admin Interface plugin <= 7.41 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-59005MEDIUMWordPress Categorify plugin <= 1.0.7.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-109664MEDIUMFrappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record ModificationEPSS 0.2%CVE-2026-109356MEDIUMLibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsControllerEPSS 0.2%CVE-2025-69333MEDIUMWordPress JetEngine plugin <= 3.8.1.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-69361MEDIUMWordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-109635MEDIUMFrappe ERPNext before 15.105.0 Missing Authorization in Document Creation EndpointsEPSS 0.2%CVE-2026-109598MEDIUMFrappe before 16.33.0 Broken Authorization via send_sms EndpointEPSS 0.2%CVE-2026-28615CRITICALIn Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalationEPSS 0.2%CVE-2026-109665MEDIUMFrappe ERPNext before 15.108.0 Missing Authorization Allows Master Record DeactivationEPSS 0.2%CVE-2025-69336MEDIUMWordPress Ultimate Store Kit Elementor Addons plugin <= 2.9.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-91713MEDIUMMissing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process EPSS 0.2%CVE-2026-109622MEDIUMFrappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing AuthorizationEPSS 0.2%