Weaknesses of type CWE-862

8,581 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-38702MEDIUMWordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-1110MEDIUMPodlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings ImportEPSS 0.5%CVE-2023-23848MEDIUMMissing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to aEPSS 0.5%CVE-2024-28230MEDIUMIn JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissionsEPSS 0.5%CVE-2024-13677HIGHGetBookingsWp - Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account TakeoverEPSS 0.5%CVE-2024-1322MEDIUMDirectorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings ChangeEPSS 0.5%CVE-2026-30845MEDIUMWekan Exposes Sensitive Data through Lack of Field Filtering During Board PublicationEPSS 0.5%CVE-2024-43974MEDIUMWordPress ReviveNews theme <= 1.0.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-13653HIGHZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.5%CVE-2025-30824MEDIUMWordPress Textmetrics plugin <= 3.6.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-1389MEDIUMPaid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_returnEPSS 0.5%CVE-2025-32252MEDIUMWordPress WP Genealogy plugin <= 0.1.9 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-12296HIGHApus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_optionsEPSS 0.5%CVE-2024-43925MEDIUMWordPress Envira Gallery Lite plugin <= 1.8.14 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-30518MEDIUMA missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumeEPSS 0.5%CVE-2024-30508MEDIUMWordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2021-24914—Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat RemovalEPSS 0.5%CVE-2022-45806MEDIUMWordPress Formidable Forms plugin <= 5.5.4 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2022-47429MEDIUMWordPress Coming Soon Landing Page and Maintenance Mode WordPress Plugin plugin <= 2.2.0 - Broken Access ControlEPSS 0.5%CVE-2025-70147HIGHMissing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackersEPSS 0.5%