Weaknesses of type CWE-862

8,581 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-53547HIGHTermix: Account Takeover via Global Settings DisclosureEPSS 0.5%CVE-2024-10531MEDIUMKognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant UpdateEPSS 0.5%CVE-2026-67440MEDIUMFUXA: Unauthenticated Socket.IO read eventsEPSS 0.5%CVE-2023-2787MEDIUMCollapsed Reply Threads APIs leak message contents from private channelsEPSS 0.5%CVE-2026-49394HIGHFrappe: Auth. bypass via update_pageEPSS 0.5%CVE-2025-23763MEDIUMWordPress WAH Forms plugin <= 1.0 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2026-6708MEDIUMHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' ParameterEPSS 0.5%CVE-2023-38483MEDIUMWordPress Instant CSS plugin <= 1.1.4 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-2222MEDIUMAdvanced Classifieds & Directory Pro <= 3.0.0 - Missing Authorization to Arbitrary Attachment DeletionEPSS 0.5%CVE-2022-41692MEDIUMWordPress Appointment Hour Booking plugin <= 1.3.71 - Missing Authorization vulnerabilityEPSS 0.5%CVE-2023-34376MEDIUMWordPress Change WooCommerce Add To Cart Button Text plugin <= 1.3 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-37989MEDIUMWordPress Easyship WooCommerce Shipping Rates plugin <= 0.9.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2022-43482MEDIUMWordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerabilityEPSS 0.5%CVE-2023-4245MEDIUMWooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information ExposureEPSS 0.5%CVE-2026-59097MEDIUMTaiga < 6.10.2 - Unauthorized Due-Date Creation via API ViewsetsEPSS 0.5%CVE-2023-38383MEDIUMWordPress Language plugin <= 1.2.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-15827MEDIUMGutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST EndpointsEPSS 0.5%CVE-2024-10762HIGHMissing Authorization in lunary-ai/lunaryEPSS 0.5%CVE-2026-63300CRITICALCross-project instance move bypasses all project restrictions allowing host command executionEPSS 0.5%CVE-2026-50222HIGHApache CloudStack: Improper access control in Userdata reference APIsEPSS 0.5%