Weaknesses of type CWE-862

8,581 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-33484HIGHLangflow has Unauthenticated IDOR on Image DownloadsEPSS 0.6%CVE-2023-36528MEDIUMWordPress kk Star Ratings plugin <= 5.4.3 - Rate Manipulation due to IP Spoofing VulnerabilityEPSS 0.6%CVE-2023-1022MEDIUMWP Meta SEO <= 4.5.3 - Missing Authorization in 'wpmsGGSaveInformation'EPSS 0.6%CVE-2023-32798MEDIUMWordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-48592MEDIUMMissing authorization check on save-job event handler in oban_webEPSS 0.6%CVE-2025-14944MEDIUMBackup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline StorageEPSS 0.6%CVE-2023-41951MEDIUMWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.6.14 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-42613CRITICALGrav: Privilege Escalation via Missing Server-Side Validation of groups/accessEPSS 0.6%CVE-2021-4074MEDIUMWHMCS Bridge <= 6.1 Subscriber+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-6685HIGHATEN eco DC Missing Authorization Privilege Escalation VulnerabilityEPSS 0.6%CVE-2024-50422MEDIUMWordPress Breeze plugin <= 2.1.14 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2022-45390MEDIUMA missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentiEPSS 0.6%CVE-2023-35051MEDIUMWordPress Contact Forms by Cimatti plugin <= 1.5.7 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-44994MEDIUMOpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config EndpointEPSS 0.6%CVE-2023-25037MEDIUMWordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-25026MEDIUMWordPress PayPal Brasil para WooCommerce plugin <= 1.4.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-4198MEDIUMDolibarr ERP CRM (<= 17.0.3) Improper Access ControlEPSS 0.6%CVE-2024-11354MEDIUMUltimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video DeletionEPSS 0.6%CVE-2023-4941MEDIUMBEAR <= 1.1.3.3 - Missing Authorization to Product ManipulationEPSS 0.6%CVE-2026-46444HIGHFlowise: Vector Store No Permission ChecksEPSS 0.6%