Weaknesses of type CWE-862

9,265 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-53820MEDIUMOpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session SpawnEPSS 0.1%CVE-2026-84551MEDIUMA logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOEPSS 0.1%CVE-2026-59677MEDIUMProcess Kill Attack Vector in killall() in seunshareEPSS 0.1%CVE-2026-19755MEDIUMNoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helperEPSS 0.1%CVE-2023-39298HIGHQTS, QuTS heroEPSS 0.1%CVE-2026-8304MEDIUMInformation Disclosure in TUBITAK BILGEM's Pardus AboutEPSS 0.1%CVE-2026-61994MEDIUMWordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-62028MEDIUMWordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-84514MEDIUMThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26EPSS 0.1%CVE-2026-62041MEDIUMWordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-107432MEDIUMWordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2026-53850MEDIUMOpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus CommandEPSS 0.1%CVE-2026-107430MEDIUMWordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerabilityEPSS 0.1%CVE-2022-38697MEDIUMIn messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additioEPSS 0.1%CVE-2026-58565HIGHDell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local acceEPSS 0.1%CVE-2026-33785MEDIUMJunos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenarioEPSS 0.1%CVE-2025-68947MEDIUMNSecsoft NSecKrnl process termination privilege escalationEPSS 0.1%CVE-2026-58562HIGHDell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local acceEPSS 0.1%CVE-2024-36326HIGHMissing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, poteEPSS 0.1%CVE-2026-43665MEDIUMThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacEPSS 0.1%