Weaknesses of type CWE-862

9,257 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-32582MEDIUMWordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-16930HIGHPower System Missing AuthorizationEPSS 0.2%CVE-2026-2463MEDIUMUnauthorized access to invite ID during team creationEPSS 0.2%CVE-2026-106646MEDIUMClassified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX HandlersEPSS 0.2%CVE-2025-59544MEDIUMChamilo: Unauthorized access to update category of any userEPSS 0.2%CVE-2026-107158MEDIUMLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST RouteEPSS 0.2%CVE-2026-100280LOWIn JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possibleEPSS 0.2%CVE-2026-20483HIGHIn Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilegEPSS 0.2%CVE-2025-41231HIGHVMware Cloud Foundation Missing Authorisation VulnerabilityEPSS 0.2%CVE-2022-20529LOWIn multiple locations of WifiDialogActivity.java, there is a possible limited lockscreen bypass due to a logic error in the code. This couldEPSS 0.2%CVE-2026-56742MEDIUMCilium: Namespaced HTTPRoutes can redirect traffic to other namespacesEPSS 0.2%CVE-2026-82746MEDIUMAsh.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden recordsEPSS 0.2%CVE-2026-108870MEDIUMJeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/dataruleEPSS 0.2%CVE-2026-108871MEDIUMJeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/dataruleEPSS 0.2%CVE-2024-32589HIGHWordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Broken Access Control to XSS vulnerabilityEPSS 0.2%CVE-2025-66105MEDIUMWordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.8 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-52954HIGHJunos OS Evolved: A low-privileged user can execute arbitrary Junos commands and modify the configuration, thereby compromising the systemEPSS 0.2%CVE-2026-108703MEDIUMCordysCRM through 1.9.3 Missing Authorization via /approval-resource/pushEPSS 0.2%CVE-2026-1217MEDIUMYoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and OverwriteEPSS 0.2%CVE-2025-7047MEDIUMMissing Authorization in Utarit Informatics' SoliClubEPSS 0.2%