Weaknesses of type CWE-862

8,577 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-6963HIGHWP Mail Gateway <= 1.8 - Missing Authorization to Authenticated (Subscriber+) SMTP Configuration Modification via 'wmg_save_provider_config' AJAX ActionEPSS 0.6%CVE-2026-44329CRITICALfree5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlersEPSS 0.6%CVE-2026-47625HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit EPSS 0.6%CVE-2025-32542HIGHWordPress Eazy Plugin Manager plugin <= 4.3.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-54475HIGHApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeoverEPSS 0.6%CVE-2025-31041HIGHWordPress AnyTrack Affiliate Link Manager plugin <= 1.0.4 - Broken Access Control VulnerabilityEPSS 0.6%CVE-2023-6840MEDIUMMissing Authorization in GitLabEPSS 0.6%CVE-2023-32677LOWUsers who can send invitations can erroneously add users to streams during invitation in ZulipEPSS 0.6%CVE-2024-3608MEDIUMProduct Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment DeletionEPSS 0.6%CVE-2023-48247MEDIUMThe vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) viEPSS 0.6%CVE-2023-6557MEDIUMThe Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information ExposureEPSS 0.6%CVE-2024-1121MEDIUMAdvanced Forms for ACF <= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings ExportEPSS 0.6%CVE-2023-2715MEDIUMGroundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket CreationEPSS 0.6%CVE-2024-33597HIGHWordPress SSU plugin <= 1.5.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-14365CRITICALTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'EPSS 0.6%CVE-2026-75027MEDIUMThemify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX ActionEPSS 0.6%CVE-2026-6804MEDIUMAI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX ActionsEPSS 0.6%CVE-2026-11398MEDIUMLatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer StepEPSS 0.6%CVE-2024-33635HIGHWordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Arbitrary Post/Page Deletion vulnerabilityEPSS 0.6%CVE-2026-12994MEDIUMWCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage ControllerEPSS 0.6%