Weaknesses of type CWE-862

8,582 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-1177MEDIUMWP Club Manager – WordPress Sports Club Plugin <= 2.2.10 - Missing Authorization to Unauthenticated Event Permalink UpdateEPSS 0.5%CVE-2023-36516HIGHWordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-0488CRITICALCode Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)EPSS 0.5%CVE-2023-28672MEDIUMJenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowiEPSS 0.5%CVE-2023-47754MEDIUMWordPress Delete Duplicate Posts Plugin <= 4.8.9 is vulnerable to Broken Access ControlEPSS 0.5%CVE-2026-27604CRITICALFOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin FunctionsEPSS 0.5%CVE-2024-39824MEDIUMZoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Missing AuthorizationEPSS 0.5%CVE-2024-10402HIGHForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and CreationEPSS 0.5%CVE-2023-23850MEDIUMA missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate EPSS 0.5%CVE-2026-78365CRITICALIDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modificationEPSS 0.5%CVE-2026-92763HIGHRundeck through 6.2.1 Authorization Bypass via Project ImportEPSS 0.5%CVE-2024-12922CRITICALAltair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_currentEPSS 0.5%CVE-2023-25791MEDIUMWordPress Fontiran plugin <= 2.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-39545MEDIUMWordPress REST API Authentication plugin <= 3.6.3 - Settings Change VulnerabilityEPSS 0.5%CVE-2026-3651MEDIUMBuild App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX ActionEPSS 0.5%CVE-2023-47112MEDIUMAuthenticated users can view job names and groups they do not have authorization to view in RundeckEPSS 0.5%CVE-2023-32295MEDIUMWordPress Easy!Appointments plugin <= 1.3.3 - Arbitrary File Deletion vulnerabilityEPSS 0.5%CVE-2026-3645MEDIUMPunnel <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX ActionEPSS 0.5%CVE-2026-35660HIGHOpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session ResetEPSS 0.5%CVE-2023-4024MEDIUMRadio Player <= 2.0.73 - Missing Authorization to Player DeletionEPSS 0.5%