Weaknesses of type CWE-862

9,245 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-108675MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTopEPSS 0.2%CVE-2026-108872MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsersEPSS 0.2%CVE-2026-108875MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroupEPSS 0.2%CVE-2025-43331MEDIUMA downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to acceEPSS 0.2%CVE-2026-108665MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/editEPSS 0.2%CVE-2026-108874MEDIUMJeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePersonEPSS 0.2%CVE-2025-68535MEDIUMWordPress Sunshine Photo Cart plugin <= 3.5.7.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-15565MEDIUMNexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status ModificationEPSS 0.2%CVE-2025-68523MEDIUMWordPress Spiffy Calendar plugin <= 5.0.7 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-3717MEDIUMCV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File UploadEPSS 0.2%CVE-2025-6730MEDIUMBonanza – WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In SuccessEPSS 0.2%CVE-2025-42915MEDIUMMissing Authorization Check in Fiori app (Manage Payment Blocks)EPSS 0.2%CVE-2025-13149MEDIUMSchedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status ModificationEPSS 0.2%CVE-2025-13756MEDIUMFluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and ManagementEPSS 0.2%CVE-2025-14392MEDIUMSimple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX ActionsEPSS 0.2%CVE-2026-24357MEDIUMWordPress WP Recipe Maker plugin <= 10.2.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-13236MEDIUMAI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056EPSS 0.2%CVE-2025-12169MEDIUMELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger DeletionEPSS 0.2%CVE-2025-12168MEDIUMPhrase TMS Integration for WordPress <= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log DeletionEPSS 0.2%CVE-2025-11164MEDIUMMavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin ActivationEPSS 0.2%