Weaknesses of type CWE-862

9,264 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-1705HIGHMissing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege EscalaEPSS 0.1%CVE-2025-13734MEDIUMIBM Engineering Requirements Management DOORS Next could allow an authenticated user to access and modify data beyond authorized permissionsEPSS 0.1%CVE-2026-96334MEDIUMWordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2023-32112LOWMissing Authorization Check in Vendor Master HierarchyEPSS 0.1%CVE-2024-20413MEDIUMCisco NX-OS Bash Privilege Escalation VulnerabilityEPSS 0.1%CVE-2026-96283LOWFlatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pullEPSS 0.1%CVE-2026-21716LOWAn incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permissioEPSS 0.1%CVE-2026-90895HIGHMISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal InjectionEPSS 0.1%CVE-2025-8887MEDIUMIDOR in Usta Information Systems' Aybs InteraktifEPSS 0.1%CVE-2022-39114MEDIUMIn Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional executEPSS 0.1%CVE-2022-39113MEDIUMIn Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional executEPSS 0.1%CVE-2026-33632HIGHClearanceKit: opfilter policy bypass via exchangedata and clone operationsEPSS 0.1%CVE-2022-39112MEDIUMIn Music service, there is a missing permission check. This could lead to local denial of service in Music service with no additional executEPSS 0.1%CVE-2026-0081CRITICALIn NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege wiEPSS 0.1%CVE-2026-0246MEDIUMPrisma Access Agent: Local Privilege Escalation VulnerabilityEPSS 0.1%CVE-2025-30017MEDIUMMissing Authorization check in SAP Solution ManagerEPSS 0.1%CVE-2026-104386MEDIUMWordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-33631HIGHClearanceKit: opfilter policy bypass via non-open file operationsEPSS 0.1%CVE-2026-11719HIGHAn authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocEPSS 0.1%CVE-2026-109696MEDIUMWordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerabilityEPSS 0.1%