Weaknesses of type CWE-862

8,590 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2023-49755MEDIUMWordPress Elementor Timeline Widget plugin <= 2.2 - Notice Dismissal VulnerabilityEPSS 0.5%CVE-2023-40670MEDIUMWordPress ReviewX plugin <= 1.6.17 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-48287MEDIUMWordPress TextMe SMS plugin <= 1.9.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-66721LOWApache CloudStack: Authorization issue with listHostTags for domain adminsEPSS 0.5%CVE-2024-49689MEDIUMWordPress HD Quiz – Save Results Light plugin <= 0.5 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-92299HIGH@jitsi/electron-sdk before 10.0.5 Unauthorized Screen CaptureEPSS 0.5%CVE-2023-46352HIGHIn the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from SmarEPSS 0.5%CVE-2024-55997MEDIUMWordPress Order Delivery & Pickup Location Date Time plugin <= 1.1.0 - Settings Change vulnerabilityEPSS 0.5%CVE-2023-27454MEDIUMWordPress Rife Elementor Extensions & Templates plugin <= 1.1.10 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-12428MEDIUMBlocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' ParameterEPSS 0.5%CVE-2024-53258HIGHdownload_all_submissions allows student to download another student's submissions in AutolabEPSS 0.5%CVE-2026-9232MEDIUMEasy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX ActionEPSS 0.5%CVE-2026-8996MEDIUMBackup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc FunctionEPSS 0.5%CVE-2024-33944MEDIUMWordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerabilityEPSS 0.5%CVE-2026-67398HIGHMissing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9EPSS 0.5%CVE-2025-30830MEDIUMWordPress Cool Author Box plugin <= 2.9.9 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-47754CRITICALunauthenticated path traversal in Metacat 2.xEPSS 0.5%CVE-2026-49956HIGHHermes WebUI < 0.51.269 Profile Isolation Bypass via sessions searchEPSS 0.5%CVE-2024-30234MEDIUMWordPress WholesaleX plugin <= 1.3.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-2107MEDIUMBlossom Spa <= 1.3.3 - Sensitive Information ExposureEPSS 0.5%