Weaknesses of type CWE-862

8,581 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-26522MEDIUMWordPress WP Repost plugin <= 0.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-32730MEDIUMMissing authorization check in SAP Enable Now ManagerEPSS 0.6%CVE-2023-2261MEDIUMWP Activity Log <= 4.5.0 - Missing Capabilities Check to User EnumerationEPSS 0.6%CVE-2024-43118MEDIUMWordPress Hummingbird plugin <= 3.9.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-55993MEDIUMWordPress Job Board Manager plugin <= 2.1.61 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-31241MEDIUMThe mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint EPSS 0.6%CVE-2026-72863CRITICALDokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker hostEPSS 0.6%CVE-2025-55144MEDIUMMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.EPSS 0.6%CVE-2026-31244MEDIUMThe mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}). TEPSS 0.6%CVE-2026-62283CRITICALNezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership checkEPSS 0.6%CVE-2024-53795MEDIUMWordPress Church Admin plugin <= 5.0.8 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-0993MEDIUMShield Security <= 17.0.17 - Missing AuthorizationEPSS 0.5%CVE-2022-41242MEDIUMA missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover infoEPSS 0.5%CVE-2023-23715MEDIUMWordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.2.2 - IDOR Leading To Job Removal VulnerabilityEPSS 0.5%CVE-2024-37296MEDIUMAimeos HTML client vulnerable to digital products download without proper payment status checkEPSS 0.5%CVE-2024-9578MEDIUMHide Links <= 1.4.2 - Unauthenticated Shortcode ExecutionEPSS 0.5%CVE-2024-31342MEDIUMWordPress Gallery Exporter plugin <= 1.3 - Arbitrary File Download vulnerabilityEPSS 0.5%CVE-2026-94501HIGHjshERP through 3.6 Privilege Escalation via userBusiness CRUDEPSS 0.5%CVE-2026-94412HIGHjshERP through 3.6 Authorization Bypass via resetPwdEPSS 0.5%CVE-2023-36815HIGHSealos billing system permission control defectEPSS 0.5%