Weaknesses of type CWE-862

8,577 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-22172CRITICALOpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth ConnectionsEPSS 0.6%CVE-2026-12432MEDIUMStripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' ParameterEPSS 0.6%CVE-2026-12994MEDIUMWCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage ControllerEPSS 0.6%CVE-2026-6804MEDIUMAI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX ActionsEPSS 0.6%CVE-2022-39975MEDIUMThe Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check EPSS 0.6%CVE-2026-11995MEDIUMGutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()EPSS 0.6%CVE-2026-12406MEDIUMUser Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' ParameterEPSS 0.6%CVE-2024-33597HIGHWordPress SSU plugin <= 1.5.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-30797CRITICALRustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled ServerEPSS 0.6%CVE-2024-1807MEDIUMProduct Sort and Display for WooCommerce <= 2.4.1 - Missing AuthorizationEPSS 0.6%CVE-2023-44227HIGHWordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File DeletionEPSS 0.6%CVE-2024-3936MEDIUMThe Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing AuthorizationEPSS 0.6%CVE-2026-64746CRITICALAn authorization issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26EPSS 0.6%CVE-2026-86777MEDIUMAlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodesEPSS 0.6%CVE-2023-41848MEDIUMWordPress Carousel Slider plugin <= 2.2.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-33667MEDIUMAn issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack by calling an endpoinEPSS 0.6%CVE-2024-3206MEDIUMDifferent Menu in Different Pages – Control Menu Visibility (All in One) <= 2.3.2 - Missing Authorization to Menu DuplicationEPSS 0.6%CVE-2026-33484HIGHLangflow has Unauthenticated IDOR on Image DownloadsEPSS 0.6%CVE-2023-32798MEDIUMWordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-48592MEDIUMMissing authorization check on save-job event handler in oban_webEPSS 0.6%