Weaknesses of type CWE-862

8,586 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-3546MEDIUMWordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory TraversalEPSS 0.5%CVE-2024-53819MEDIUMWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.5%CVE-2026-75018MEDIUMCustom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' ParametersEPSS 0.5%CVE-2024-48538CRITICALIncorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information bEPSS 0.5%CVE-2024-0617MEDIUMCategory Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()EPSS 0.5%CVE-2026-47100HIGHFunnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAXEPSS 0.5%CVE-2024-33576MEDIUMWordPress WPPizza plugin <= 3.18.10 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-38777MEDIUMWordPress Titan Anti-spam & Security plugin <= 7.3.6 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-47394HIGHPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validateEPSS 0.5%CVE-2023-47826MEDIUMWordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.3 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-40001MEDIUMWordPress iThemes Sync plugin <= 2.1.13 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-43979MEDIUMWordPress Blockbooster theme <= 1.0.10 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-54326MEDIUMWordPress GEO my WP plugin <= 4.5.0.4 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-27608MEDIUMWordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-85589MEDIUMphpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard APIEPSS 0.5%CVE-2025-30880HIGHWordPress JS Help Desk plugin <= 2.9.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-49291HIGHmcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/callEPSS 0.5%CVE-2026-65916HIGHCyberPanel Missing Authorization in cancelBackupCreation HandlerEPSS 0.5%CVE-2026-7520HIGHMailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX ActionEPSS 0.5%CVE-2026-9175MEDIUMDevs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' ParameterEPSS 0.5%