Weaknesses of type CWE-862

8,591 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-2107MEDIUMBlossom Spa <= 1.3.3 - Sensitive Information ExposureEPSS 0.5%CVE-2024-53938HIGHAn issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELNET service is enabledEPSS 0.5%CVE-2026-30823HIGHFlowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO ConfigurationEPSS 0.5%CVE-2026-16184HIGHIBM WebSphere Application Server is affected by an authentication bypassEPSS 0.5%CVE-2024-30234MEDIUMWordPress WholesaleX plugin <= 1.3.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-8684MEDIUMMotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX ActionEPSS 0.5%CVE-2026-9028MEDIUMCorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' ParameterEPSS 0.5%CVE-2026-3506MEDIUMWP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration TakeoverEPSS 0.5%CVE-2026-13250MEDIUMSolace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX ActionEPSS 0.5%CVE-2026-15106MEDIUMWPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' ParameterEPSS 0.5%CVE-2023-39438HIGHMissing Authorization check allows certain operations on CLA Assistant dataEPSS 0.5%CVE-2022-40223MEDIUMWordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerabilityEPSS 0.5%CVE-2026-15349MEDIUMERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX HandlerEPSS 0.5%CVE-2022-44633MEDIUMWordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerabilityEPSS 0.5%CVE-2026-7620MEDIUMNotification for Telegram <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX ActionEPSS 0.5%CVE-2026-9857MEDIUMInvoice123 <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actionsEPSS 0.5%CVE-2026-9015MEDIUMEqualize Digital Accessibility Checker <= 1.42.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX ActionEPSS 0.5%CVE-2026-7525MEDIUMMy Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' ParameterEPSS 0.5%CVE-2024-56238MEDIUMWordPress Floating Action Buttons plugin <= 0.9.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-32506MEDIUMWordPress Link Whisper Free plugin <= 0.6.3 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.5%