Weaknesses of type CWE-862

10,119 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2018-25019—LearnDash < 2.5.4 - Unauthenticated Arbitrary File UploadEPSS 1.6%CVE-2011-4183MEDIUMopen build service allows anyone to upload rpmsEPSS 1.6%CVE-2021-4356CRITICALFrontend File Manager <= 18.2 - Unauthenticated Arbitrary File DownloadEPSS 1.5%CVE-2021-25002—Tipsacarrier < 1.5.0.5 - Unauthenticated Orders DisclosureEPSS 1.5%CVE-2026-12646CRITICALA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cEPSS 1.5%CVE-2026-12647CRITICALA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cEPSS 1.5%CVE-2026-12645CRITICALA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cEPSS 1.5%CVE-2021-25087—Wordpress Download Manager < 3.2.25 - Sensitive Information DisclosureEPSS 1.5%CVE-2022-41326CRITICALThe web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due toEPSS 1.5%CVE-2024-5324HIGHXootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options UpdateEPSS 1.5%CVE-2024-30464MEDIUMWordPress Social Icons Widget & Block by WPZOOM plugin <= 4.2.15 - Broken Access Control vulnerabilityEPSS 1.5%CVE-2026-48168CRITICALPraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch nameEPSS 1.5%CVE-2024-11281CRITICALWooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email ChangeEPSS 1.5%CVE-2021-24977—Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS AppendingEPSS 1.5%CVE-2021-24906—Protect WP Admin < 3.6.2 - Unauthenticated Plugin DeactivationEPSS 1.5%CVE-2021-24354—Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin InstallationEPSS 1.5%CVE-2024-43998MEDIUMWordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerabilityEPSS 1.5%CVE-2023-6700HIGHCookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 1.5%CVE-2022-1245—A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding aEPSS 1.4%CVE-2024-31987CRITICALXWiki Platform remote code execution from account via custom skins supportEPSS 1.4%