Weaknesses of type CWE-862

9,258 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2022-20503HIGHIn onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration due to a missing permiEPSS 0.2%CVE-2026-87860MEDIUMSubscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRFEPSS 0.2%CVE-2026-106344MEDIUMMissing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer procEPSS 0.2%CVE-2026-97176MEDIUMKeycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticatorEPSS 0.2%CVE-2022-20506HIGHIn onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of privilege from a guest uEPSS 0.2%CVE-2023-44214MEDIUMSensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) beEPSS 0.2%CVE-2022-38670HIGHIn soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additioEPSS 0.2%CVE-2023-45242MEDIUMSensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (LinuxEPSS 0.2%CVE-2023-45240MEDIUMSensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) beEPSS 0.2%CVE-2025-15473MEDIUMTimetics < 1.0.52 - Unauthenticated Payment/Booking Status UpdateEPSS 0.2%CVE-2022-38669HIGHIn soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additioEPSS 0.2%CVE-2022-2985HIGHIn music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execEPSS 0.2%CVE-2026-94260MEDIUMSifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order FailureEPSS 0.2%CVE-2026-105975MEDIUMCamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_referenceEPSS 0.2%CVE-2026-104751MEDIUMRank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results DeletionEPSS 0.2%CVE-2026-94360MEDIUMPaymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card CallbacksEPSS 0.2%CVE-2026-66061HIGHHome Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation executionEPSS 0.2%CVE-2026-66060HIGHHome Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callersEPSS 0.2%CVE-2026-86850MEDIUMSKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation DeletionEPSS 0.2%CVE-2026-55530MEDIUMPraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation toolEPSS 0.2%