Weaknesses of type CWE-862

8,591 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2024-11715MEDIUMWP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege EscalationEPSS 0.5%CVE-2023-38477MEDIUMWordPress QR code MeCard/vCard generator plugin <= 1.6.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2022-41790MEDIUMWordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access ControlEPSS 0.5%CVE-2026-63219HIGHUnauthenticated file upload via missing authorization on formatter upload endpointEPSS 0.5%CVE-2024-33594HIGHWordPress Leaky Paywall plugin <= 4.20.8 - Price Manipulation vulnerabilityEPSS 0.5%CVE-2024-43973MEDIUMWordPress GetPaid plugin <= 2.8.11 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2022-4972HIGHDownload Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data ExportEPSS 0.5%CVE-2026-9014MEDIUMWP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX ActionEPSS 0.5%CVE-2026-5427MEDIUMKubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block AttributesEPSS 0.5%CVE-2021-47662HIGHUnauthenticated remote shutdown of the cobotEPSS 0.5%CVE-2026-58434HIGHPrivate Repository Metadata Remains Accessible After Access RevocationEPSS 0.5%CVE-2023-32586MEDIUMWordPress SoundCloud Is Gold plugin <= 2.5.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-5940MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings UpdateEPSS 0.5%CVE-2023-2275MEDIUMWooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST APIEPSS 0.5%CVE-2026-58438HIGHCross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot accessEPSS 0.5%CVE-2025-57899MEDIUMWordPress WP Compress Plugin <= 6.50.54 - Broken Access Control VulnerabilityEPSS 0.5%CVE-2026-52828MEDIUMKimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD AccessEPSS 0.5%CVE-2022-45351MEDIUMWordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-3662MEDIUMWPZOOM Social Feed Widget & Block <= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image DeletionEPSS 0.5%CVE-2025-6190HIGHRealty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() FunctionEPSS 0.5%