Weaknesses of type CWE-862

9,247 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-11164MEDIUMMavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin ActivationEPSS 0.2%CVE-2025-6730MEDIUMBonanza – WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In SuccessEPSS 0.2%CVE-2025-13149MEDIUMSchedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status ModificationEPSS 0.2%CVE-2025-14392MEDIUMSimple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX ActionsEPSS 0.2%CVE-2025-12023MEDIUMELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket RestoreEPSS 0.2%CVE-2026-100537LOWOpenClaw before 2026.8.1 Authentication Bypass via Active MemoryEPSS 0.2%CVE-2025-14370MEDIUMQuote Comments <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings UpdateEPSS 0.2%CVE-2026-24357MEDIUMWordPress WP Recipe Maker plugin <= 10.2.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-12574MEDIUMListar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post DeletionEPSS 0.2%CVE-2025-12169MEDIUMELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger DeletionEPSS 0.2%CVE-2026-13236MEDIUMAI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056EPSS 0.2%CVE-2025-14395MEDIUMPopover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX ActionsEPSS 0.2%CVE-2026-25034MEDIUMWordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-42915MEDIUMMissing Authorization Check in Fiori app (Manage Payment Blocks)EPSS 0.2%CVE-2025-12022MEDIUMELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash RestoreEPSS 0.2%CVE-2025-12640MEDIUMFolders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media ReplacementEPSS 0.2%CVE-2025-64229MEDIUMWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-106598MEDIUMWordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2024-40709HIGHA missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level.EPSS 0.2%CVE-2026-109703MEDIUMWordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerabilityEPSS 0.2%