Weaknesses of type CWE-862

8,585 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-23823MEDIUMWordPress Enhanced Text Widget plugin <= 1.5.8 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-38386HIGHWordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-41869MEDIUMWordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.4 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-24618MEDIUMWordPress ElementInvader Addons for Elementor Plugin <= 1.3.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-36518MEDIUMWordPress Post Hit Counter plugin <= 1.3.2 - Broken Access ControlEPSS 0.5%CVE-2025-24591MEDIUMWordPress GDPR CCPA Compliance & Cookie Consent Banner plugin <= 2.7.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-54310MEDIUMWordPress Gou Manage My Account Menu plugin <= 1.0.1.8 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-16300CRITICALChama < 1.0.13 - Unauthenticated Arbitrary User Password ResetEPSS 0.5%CVE-2023-51362MEDIUMWordPress myStickyElements plugin <= 2.1.3 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-51357MEDIUMWordPress Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-44147MEDIUMWordPress Comment Blacklist Updater plugin <= 1.1.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-41849MEDIUMWordPress Posts Like Dislike plugin <= 1.1.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-48750MEDIUMWordPress Void Elementor Post Grid Addon for Elementor Page builder plugin <= 2.1.10 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-50887MEDIUMWordPress User Feedback plugin <= 1.0.10 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-52229MEDIUMWordPress Word Replacer Pro plugin <= 1.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-81648CRITICALCryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX RouterEPSS 0.5%CVE-2023-49832MEDIUMWordPress Site Reviews plugin <= 6.10.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-82885HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.5%CVE-2026-81211HIGHLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guardsEPSS 0.5%CVE-2026-57850HIGHRustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message InjectionEPSS 0.5%