Weaknesses of type CWE-862

9,259 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-100854MEDIUMAzuraCast before 0.23.6 Metadata Injection via Liquidsoap APIEPSS 0.2%CVE-2026-106369MEDIUMMissing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer procesEPSS 0.2%CVE-2026-96551MEDIUMsfturing hosp_order CommonUserController.java cross-site request forgeryEPSS 0.2%CVE-2026-106095LOWCode Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippetEPSS 0.2%CVE-2026-102397MEDIUMWordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-97075MEDIUMWordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2022-20556LOWIn launchConfigNewNetworkFragment of NetworkProviderSettings.java, there is a possible way for the guest user to add a new WiFi network due EPSS 0.2%CVE-2023-48683HIGHSensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect CEPSS 0.2%CVE-2026-105706MEDIUMSourceCodester Drug Recommendation System cross-site request forgeryEPSS 0.2%CVE-2026-107623MEDIUMKeycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocationEPSS 0.2%CVE-2026-90454MEDIUMMissing authorization in MalcolmEPSS 0.2%CVE-2026-90508MEDIUMChengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorizationEPSS 0.2%CVE-2022-39092HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2026-15550MEDIUMNinja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init HookEPSS 0.2%CVE-2025-43000HIGHInformation Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW)EPSS 0.2%CVE-2022-39091HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2026-82964HIGHAvast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sysEPSS 0.2%CVE-2022-39090HIGHIn power management service, there is a missing permission check. This could lead to set up power management service with no additional execEPSS 0.2%CVE-2026-16190LOWIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesEPSS 0.2%CVE-2022-20519LOWIn onCreate of AddAppNetworksActivity.java, there is a possible way for a guest user to configure WiFi networks due to a missing permission EPSS 0.2%