Weaknesses of type CWE-862

8,512 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-23615MEDIUMWordPress Interactive Page Hierarchy plugin <= 1.0.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-25469MEDIUMWordPress Easy Table of Contents plugin <= 2.0.45.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-41688MEDIUMWordPress Bulk NoIndex & NoFollow Toolkit plugin <= 1.5 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-2086MEDIUMEssential Blocks <= 4.0.6 - Missing Authorization via template_countEPSS 0.6%CVE-2025-52352CRITICALAikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hidingEPSS 0.6%CVE-2022-4932MEDIUMTotal Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information DisclosureEPSS 0.6%CVE-2023-36526MEDIUMWordPress Duplicate Post Page Menu & Custom Post Type plugin <= 2.4.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-50884MEDIUMWordPress LA-Studio Element Kit for Elementor plugin <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-51353MEDIUMWordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2021-42062—SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain areaEPSS 0.6%CVE-2023-49831HIGHWordPress RegistrationMagic plugin <= 5.2.3.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2025-70146CRITICALMissing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remotEPSS 0.6%CVE-2023-36684HIGHWordPress Convert Pro plugin <= 1.7.5 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-30532MEDIUMA missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobEPSS 0.6%CVE-2025-31822MEDIUMWordPress WordPress Simple HTML Sitemap plugin <= 3.4 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-82923CRITICALAI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST RoutesEPSS 0.6%CVE-2025-39531MEDIUMWordPress Slazzer Background Changer plugin <= 3.14 - Broken Access Control VulnerabilityEPSS 0.6%CVE-2025-31773MEDIUMWordPress Ship Per Product plugin <= 2.1.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2025-30821MEDIUMWordPress SNORDIAN's H5PxAPIkatchu plugin <= 0.4.14 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2025-24596MEDIUMWordPress WooCommerce Product Table Lite plugin <= 3.8.7 - Broken Access Control vulnerabilityEPSS 0.6%