Weaknesses of type CWE-862

10,142 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-12472MEDIUMKirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' ParametersEPSS 0.6%CVE-2023-0719MEDIUMWicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_orderEPSS 0.6%CVE-2023-2280MEDIUMWP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_actionEPSS 0.6%CVE-2023-0712MEDIUMWicked Folders <= 2.18.16 - Missing Authorization on ajax_move_objectEPSS 0.6%CVE-2022-38057MEDIUMWordPress TH Advance Product Search plugin <= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerabilityEPSS 0.6%CVE-2023-38475MEDIUMWordPress Donations Made Easy – Smart Donations plugin <= 4.0.12 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2022-45399MEDIUMA missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster StatisEPSS 0.6%CVE-2023-34019MEDIUMWordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-37971MEDIUMWordPress WooCommerce Product Stock Alert plugin <= 2.0.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-35046MEDIUMWordPress Dynamic Visibility for Elementor plugin <= 5.0.5 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2022-45394MEDIUMA missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs.EPSS 0.6%CVE-2023-32581MEDIUMWordPress WP-Chatbot for Messenger plugin <= 4.7 - Broken Access ControlEPSS 0.6%CVE-2024-12553MEDIUMGeoVision GV-ASManager Missing Authorization Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-119495MEDIUMWordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-18316CRITICALSolace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX ActionEPSS 0.6%CVE-2026-32622HIGHSQLBot: Remote Code Execution via Terminology PoisoningEPSS 0.6%CVE-2024-1387MEDIUMHappy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information ExposureEPSS 0.6%CVE-2026-54628HIGHAnyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server ModeEPSS 0.6%CVE-2026-56767HIGHMaxun < 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API HandlersEPSS 0.6%CVE-2022-46850HIGHWordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File DeletionEPSS 0.6%