Weaknesses of type CWE-862

8,581 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-25067MEDIUMWordPress We’re Open! plugin <= 1.45 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-15541MEDIUMwill-moss Isaiah Master Websocket server.go Server.Handle authorizationEPSS 0.5%CVE-2023-25486MEDIUMWordPress Clone plugin <= 2.3.7 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-13468HIGHTrash Duplicate and 301 Redirect <= 1.9 - Missing Authorization to Unauthenticated Arbitrary Post DeletionEPSS 0.5%CVE-2022-4943HIGHminiOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings ChangeEPSS 0.5%CVE-2023-29529MEDIUMmatrix-js-sdk vulnerable to invisible eavesdropping in group callsEPSS 0.5%CVE-2024-10529MEDIUMKognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant DeletionEPSS 0.5%CVE-2023-30526MEDIUMA missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an atEPSS 0.5%CVE-2023-50375MEDIUMWordPress Translate WordPress – Google Language Translator plugin <= 6.0.19 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2022-45070MEDIUMWordPress Conditional Checkout Fields for WooCommerce plugin <= 1.2.3 - Broken Authentication vulnerabilityEPSS 0.5%CVE-2023-32507HIGHWordPress Woo Custom Emails plugin <= 2.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-93737HIGHAzkaban through 4.0.0 Authorization Bypass via ScheduleServletEPSS 0.5%CVE-2023-6637MEDIUMCAOS | Host Google Analytics Locally <= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings UpdateEPSS 0.5%CVE-2026-86591CRITICALBotiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST RouteEPSS 0.5%CVE-2024-1094HIGHTimetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege EscalationEPSS 0.5%CVE-2023-25703MEDIUMWordPress Meta slider and carousel with lightbox plugin <= 1.6.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-6638MEDIUMGTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings UpdateEPSS 0.5%CVE-2023-23725MEDIUMWordPress Shortcodes by Angie Makes plugin <= 3.46 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-39429HIGHkcp's cache server is accessible without authentication or authorization checksEPSS 0.5%CVE-2026-53547HIGHTermix: Account Takeover via Global Settings DisclosureEPSS 0.5%