Weaknesses of type CWE-862

8,590 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2025-32219MEDIUMWordPress eaSYNC plugin <= 1.3.19 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-23917MEDIUMWordPress Chamber Dashboard Business Directory Plugin <= 3.3.8 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-32817CRITICALAdmidio is Missing Authorization and CSRF Protection on Document and Folder DeletionEPSS 0.5%CVE-2024-51671LOWWordPress Otter Blocks plugin <= 3.0.3 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-13719MEDIUMPeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information ExposureEPSS 0.5%CVE-2025-32178MEDIUMWordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-32246MEDIUMWordPress 1-Click Backup & Restore Database plugin <= 1.0.3 - Broken Access Control VulnerabilityEPSS 0.5%CVE-2025-31774MEDIUMWordPress plugin Astra Security Suite plugin<= 0.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-32218MEDIUMWordPress TableOn plugin <= 1.0.5.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-32224MEDIUMWordPress Privyr CRM plugin <= 1.0.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-50628HIGHAn issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an attacker on the local area network to achievEPSS 0.5%CVE-2023-27309MEDIUMA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails EPSS 0.5%CVE-2026-92299HIGH@jitsi/electron-sdk before 10.0.5 Unauthorized Screen CaptureEPSS 0.5%CVE-2026-66721LOWApache CloudStack: Authorization issue with listHostTags for domain adminsEPSS 0.5%CVE-2020-27777—A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot)EPSS 0.5%CVE-2022-41698MEDIUMWordPress If Menu – Visibility control for Menus plugin <= 0.16.3 - Broken Access ControlEPSS 0.5%CVE-2024-38726HIGHWordPress Product Designer plugin <= 1.0.33 - Arbitrary Content Deletion vulnerabilityEPSS 0.5%CVE-2024-10900MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta DeletionEPSS 0.5%CVE-2023-40670MEDIUMWordPress ReviewX plugin <= 1.6.17 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-49755MEDIUMWordPress Elementor Timeline Widget plugin <= 2.2 - Notice Dismissal VulnerabilityEPSS 0.5%