Weaknesses of type CWE-862

8,541 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2021-42062—SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain areaEPSS 0.6%CVE-2026-4030HIGHDatabase Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and DeletionEPSS 0.6%CVE-2025-70146CRITICALMissing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remotEPSS 0.6%CVE-2023-36684HIGHWordPress Convert Pro plugin <= 1.7.5 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-30532MEDIUMA missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobEPSS 0.6%CVE-2026-3595MEDIUMRiaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' ParameterEPSS 0.6%CVE-2025-31822MEDIUMWordPress WordPress Simple HTML Sitemap plugin <= 3.4 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-80348HIGHTarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete EndpointsEPSS 0.6%CVE-2025-31773MEDIUMWordPress Ship Per Product plugin <= 2.1.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-82882HIGHDevtron through 2.2.0 Missing Authorization via webhook API token endpointEPSS 0.6%CVE-2026-72883HIGHDokploy: WebSocket Terminal Missing Service-Level Access ControlEPSS 0.6%CVE-2025-30821MEDIUMWordPress SNORDIAN's H5PxAPIkatchu plugin <= 0.4.14 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-54671HIGHWeGIA: Authorization Bypass via Empty Resource Array in InternoControleEPSS 0.6%CVE-2025-39513MEDIUMWordPress ActiveDEMAND plugin <= 0.2.46 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2025-24596MEDIUMWordPress WooCommerce Product Table Lite plugin <= 3.8.7 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2025-39531MEDIUMWordPress Slazzer Background Changer plugin <= 3.14 - Broken Access Control VulnerabilityEPSS 0.6%CVE-2026-72866HIGHWebSocket Terminal Auth BypassEPSS 0.6%CVE-2024-32948CRITICALWordPress ARMember – Membership Plugin plugin <= 4.0.28 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-25048MEDIUMWordPress Fantastic Content Protector Free plugin <= 2.6 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-46515CRITICALFrogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL executionEPSS 0.6%