Weaknesses of type CWE-862

8,586 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-81648CRITICALCryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX RouterEPSS 0.5%CVE-2023-50887MEDIUMWordPress User Feedback plugin <= 1.0.10 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-82885HIGHIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.5%CVE-2023-51357MEDIUMWordPress Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-25039MEDIUMWordPress Google Maps CP plugin <= 1.0.43 - Missing Authorization Leading To Feedback Submission VulnerabilityEPSS 0.5%CVE-2023-47805MEDIUMWordPress WPCafe plugin <= 2.2.22 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-1637MEDIUM360 Javascript Viewer <= 1.7.12 - Missing Authorization to Plugin Settings UpdateEPSS 0.5%CVE-2026-3045HIGHAppointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API EndpointEPSS 0.5%CVE-2026-72910HIGHERPNext: Unauthorised modification of master data due to missing validationEPSS 0.5%CVE-2026-4029HIGHDatabase Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database ExportEPSS 0.5%CVE-2026-92456HIGHyshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration EndpointsEPSS 0.5%CVE-2023-3315MEDIUMMissing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the exiEPSS 0.5%CVE-2024-37209MEDIUMWordPress User Rights Access Manager plugin <= 1.1.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-40003MEDIUMWordPress WP Project Manager plugin <= 2.6.7 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-54943CRITICALSUNNET Corporate Training Management System - Missing AuthorizationEPSS 0.5%CVE-2026-57830HIGHJoomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7EPSS 0.5%CVE-2025-5486CRITICALWP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password ResetEPSS 0.5%CVE-2022-43431MEDIUMJenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers wiEPSS 0.5%CVE-2026-55863MEDIUMmotionEye: Missing authentication on ActionHandler allows unauthenticated camera action executionEPSS 0.5%CVE-2026-5387CRITICALAVEVA Pipeline Simulation Missing AuthorizationEPSS 0.5%