Weaknesses of type CWE-862

8,591 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-1122MEDIUMEvent Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events ExportEPSS 0.5%CVE-2025-4477HIGHTeamT5 ThreatSonar Anti-Ransomware - Privilege EscalationEPSS 0.5%CVE-2024-1095MEDIUMBuild & Control Block Patterns – Boost up Gutenberg Editor <= 1.3.5.4 - Missing AuthorizationEPSS 0.5%CVE-2023-40331MEDIUMWordPress Accordion Slider plugin <= 1.9.6 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-7726MEDIUMLayouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX ActionEPSS 0.5%CVE-2026-81819MEDIUMFlowintel Missing Authorization Allows Regular API Users to View Other Users’ Task AssignmentsEPSS 0.5%CVE-2023-34387MEDIUMWordPress Constant Contact Forms plugin <= 2.0.3 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-32599MEDIUMWordPress reCAPTCHA for all plugin <= 1.22 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-23814LOWWordPress Calendar Event Multi View plugin <= 1.4.13 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-49192MEDIUMWordPress Enhanced Text Widget plugin <= 1.6.3 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-3761CRITICALMissing Authorization on Delete Datasets in lunary-ai/lunaryEPSS 0.5%CVE-2023-49193MEDIUMWordPress Grow Social plugin <= 1.30.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-13800HIGHPopup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateEPSS 0.5%CVE-2023-41132MEDIUMWordPress Category Slider for WooCommerce plugin <= 1.4.15 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-34009MEDIUMWordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.1 - Broken Access Control + CSRFEPSS 0.5%CVE-2024-7621MEDIUMVisual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings UpdateEPSS 0.5%CVE-2025-6993HIGHUltimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details FunctionEPSS 0.5%CVE-2023-27456MEDIUMWordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin ActivationEPSS 0.5%CVE-2022-21953HIGHAuthenticated user can gain unauthorized shell pod and kubectl access in the local cluster EPSS 0.5%CVE-2023-28990MEDIUMWordPress Viral Mag theme <= 1.0.9 - Authenticated Arbitrary Plugin Activation VulnerabilityEPSS 0.5%