Weaknesses of type CWE-862

8,581 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-4282MEDIUMEmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_dataEPSS 0.5%CVE-2024-1850MEDIUMAI Post Generator | AutoWriter <= 3.3 - Missing AuthorizationEPSS 0.5%CVE-2024-43980MEDIUMWordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-24594MEDIUMWordPress Linet ERP-Woocommerce Integration plugin <= 3.5.7 - CSRF to Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-52554HIGHJenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that theEPSS 0.5%CVE-2026-54519HIGHAI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletionEPSS 0.5%CVE-2025-24588MEDIUMWordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-2353MEDIUMCHP Ads Block Detector <= 3.9.4 - Missing Authorization to Plugin Settings UpdateEPSS 0.5%CVE-2023-33321MEDIUMWordPress EventPrime plugin <= 2.8.6 - Sensitive Data ExposureEPSS 0.5%CVE-2024-1677MEDIUMPrint Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Improper AuthorizationEPSS 0.5%CVE-2025-21498MEDIUMVulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 1EPSS 0.5%CVE-2024-32682HIGHWordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-32220MEDIUMWordPress Salon booking system plugin <= 10.30.23 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-53803MEDIUMWordPress WP Mailster plugin <= 1.8.16.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-46413MEDIUMDiscourse: Regular users can route multipart uploads into the admin backup storeEPSS 0.5%CVE-2023-0404MEDIUMEvents Made Easy <= 2.3.16 - Missing AuthorizationEPSS 0.5%CVE-2023-34186MEDIUMWordPress Headless CMS plugin <= 2.0.3 - Broken Authentication vulnerabilityEPSS 0.5%CVE-2024-1318MEDIUMRSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and PublicationEPSS 0.5%CVE-2024-11443HIGHde:branding <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.5%CVE-2023-2084MEDIUMEssential Blocks <= 4.0.6 - Missing Authorization via getEPSS 0.5%