Weaknesses of type CWE-862

8,581 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-47409HIGHpraisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}EPSS 0.5%CVE-2026-92803MEDIUMLibreTranslate through 1.9.6 Missing Access Check on the download_file RouteEPSS 0.5%CVE-2025-1021HIGHMissing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 EPSS 0.5%CVE-2026-72723MEDIUMDiscourse: Anonymous sidebar serialization exposes descriptions of category-restricted tagsEPSS 0.5%CVE-2024-3599MEDIUMWP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post DeletionEPSS 0.5%CVE-2023-51355HIGHWordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-47412HIGHpraisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}EPSS 0.5%CVE-2024-12259HIGHCRM WordPress Plugin – RepairBuddy <= 3.8120 - Missing Authorization to Account Takeover/Privilege EscalationEPSS 0.5%CVE-2026-22182HIGHwpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationTypeEPSS 0.5%CVE-2021-25018—PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSSEPSS 0.5%CVE-2023-27462LOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affected application fails EPSS 0.5%CVE-2021-24950—Insight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSSEPSS 0.5%CVE-2025-23486MEDIUMWordPress Database Sync plugin <= 0.5.1 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2021-25042—WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSSEPSS 0.5%CVE-2023-24524MEDIUMSAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in EPSS 0.5%CVE-2026-45625CRITICALArcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configsEPSS 0.5%CVE-2024-4520HIGHImproper Access Control in gaizhenbiao/chuanhuchatgptEPSS 0.5%CVE-2026-14488CRITICALMeta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' ParameterEPSS 0.5%CVE-2026-92780HIGHKnowStreaming through 3.4.1 Missing Authorization on the REST APIEPSS 0.5%CVE-2026-40601HIGHChartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggleEPSS 0.5%