Weaknesses of type CWE-862

10,119 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2019-3879MEDIUMIt was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the peEPSS 1.8%CVE-2024-12365HIGHW3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request ForgeryEPSS 1.8%CVE-2024-50967MEDIUMThe /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remEPSS 1.8%CVE-2026-24421MEDIUMphpMyFAQ missing authorization exposes /api/setup/backup to any authenticated userEPSS 1.7%CVE-2024-47308MEDIUMWordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerabilityEPSS 1.7%CVE-2024-10674HIGHTh Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/ActivationEPSS 1.7%CVE-2020-25718—A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This EPSS 1.7%CVE-2015-10140HIGHAjax Load More < 2.8.1.2 - Subscriber+ File Upload & DeletionEPSS 1.7%CVE-2026-40502HIGHOpenHarness Remote Administrative Command Injection via Gateway HandlerEPSS 1.7%CVE-2021-39232—Missing admin check for SCM related admin commandsEPSS 1.7%CVE-2017-7530HIGHIn CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitEPSS 1.7%CVE-2021-27859HIGHMissing authorization vulnerability in FatPipe softwareEPSS 1.7%CVE-2019-6580—A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), SivEPSS 1.7%CVE-2024-10629HIGHGPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File CreationEPSS 1.7%CVE-2023-7317CRITICALNagios XI < 2024R1 Web SSH Terminal Missing Access ControlEPSS 1.7%CVE-2021-27855HIGHFatPipe software allows privilege escalationEPSS 1.7%CVE-2026-11801HIGHWPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST EndpointEPSS 1.6%CVE-2026-27833HIGHPiwigo: Unauthenticated Information Disclosure via pwg.history.search APIEPSS 1.6%CVE-2024-54369CRITICALWordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerabilityEPSS 1.6%CVE-2026-18110HIGHConcrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, usernameEPSS 1.6%