Weaknesses of type CWE-862

10,119 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2020-22007MEDIUMOS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute arEPSS 2.3%CVE-2020-36730HIGHCMP <= 3.8.1 - Missing AuthorizationEPSS 2.3%CVE-2025-5701HIGHHyperComments <= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options UpdateEPSS 2.2%CVE-2021-47812CRITICALGravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)EPSS 2.2%CVE-2025-1307CRITICALNewscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 2.2%CVE-2024-10586CRITICALDebug Tool <= 2.2 - Unauthenticated Arbitrary File CreationEPSS 2.1%CVE-2024-9161MEDIUMRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and DeleteEPSS 2.1%CVE-2026-10768CRITICALLocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039EPSS 2.1%CVE-2022-4939CRITICALWCFM Membership <= 2.10.0 - Unauthenticated Privilege EscalationEPSS 2.1%CVE-2026-34976CRITICALDgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing AuthorizationEPSS 2.1%CVE-2023-0291HIGHQuiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media DeletionEPSS 2.0%CVE-2020-5368CRITICALDell EMC VxRail versions 4.7.410 and 4.7.411 contain an improper authentication vulnerability. A remote unauthenticated attacker may exploitEPSS 2.0%CVE-2026-6639HIGHAI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information ExposureEPSS 2.0%CVE-2022-2373—Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address DisclosureEPSS 2.0%CVE-2022-2376—Directorist < 7.3.1 - Unauthenticated Email Address DisclosureEPSS 2.0%CVE-2022-29176CRITICALUnauthorized gem takeover for some gems on rubygems.orgEPSS 1.9%CVE-2024-50417MEDIUMWordPress Bold Page Builder plugin <= 5.1.3 - Broken Access Control vulnerabilityEPSS 1.9%CVE-2021-27857HIGHFatPipe software allows unauthenticated configuration downloadEPSS 1.9%CVE-2021-4368CRITICALFrontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File UploadEPSS 1.9%CVE-2023-5311HIGHWP EXtra <= 6.2 - Missing Authorization to .htaccess File ModificationEPSS 1.9%