Weaknesses of type CWE-862

8,589 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-51817MEDIUMWordPress Combo WP Rewrite Slugs plugin <= 1.0 - Settings Change vulnerabilityEPSS 0.5%CVE-2026-84238CRITICALWordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-3475MEDIUMInstant Popup Builder <= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' ParameterEPSS 0.5%CVE-2020-36667MEDIUMJetBackup – WP Backup, Migrate & Restore <= 1.4.1 - Missing Authorization to Unauthorized Backup Location ChangeEPSS 0.5%CVE-2026-28005CRITICALWordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2023-48274MEDIUMWordPress WCMultiShipping plugin <= 2.3.5 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2021-38164MEDIUMSAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, EPSS 0.5%CVE-2026-80191HIGHGROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated RequestsEPSS 0.5%CVE-2024-30487HIGHWordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-2906MEDIUMWordPress Radio Player plugin <= 2.0.73 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-40852HIGHThis issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be EPSS 0.5%CVE-2023-49757MEDIUMWordPress Awesome Support plugin <= 6.1.10 - Broken Access Control + CSRF vulnerabilityEPSS 0.5%CVE-2023-48324MEDIUMWordPress Awesome Support HelpDesk plugin <= 6.1.4 - Broken Access control vulnerabilityEPSS 0.5%CVE-2024-4319MEDIUMAdvanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information DisclosureEPSS 0.5%CVE-2023-36504MEDIUMWordPress BBS e-Popup plugin <= 2.4.5 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-25038HIGHGitea private organization labels are visible to unauthorized usersEPSS 0.5%CVE-2023-48774MEDIUMWordPress IdeaPush plugin < 8.58 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-90535MEDIUMFlowise before 3.1.4 Denial of Service via text-to-speech/abortEPSS 0.5%CVE-2026-73843CRITICALOpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIsEPSS 0.5%CVE-2024-13060MEDIUMImproper Authorization in mintplex-labs/anything-llmEPSS 0.5%