Falhas do tipo CWE-862

8.876 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2025-53291MEDIUMWordPress Spreadconnect plugin <= 2.1.5 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-58603MEDIUMWordPress Surfer Plugin <= 1.6.4.574 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-47565MEDIUMWordPress EventON plugin <= 4.9.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-12855MEDIUMAdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment DeletionEPSS 0.3%CVE-2026-34154LOWDiscourse has a subscription access bypass in its discourse-subscriptions pluginEPSS 0.3%CVE-2025-62892MEDIUMWordPress Sunshine Photo Cart plugin <= 3.5.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-15563MEDIUMBroken Access Control results in Denial of Service in NesterSoft WorkTimeEPSS 0.3%CVE-2026-79110MEDIUMMissing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftedEPSS 0.3%CVE-2026-81916MEDIUMIncorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized ObjectEPSS 0.3%CVE-2026-54029MEDIUMLibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User FilterEPSS 0.3%CVE-2026-0817MEDIUMCampaignEvents API missing authorization exposes meeting and chat URLsEPSS 0.3%CVE-2025-27437MEDIUMMissing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface)EPSS 0.3%CVE-2026-18120MEDIUMMissing Authorization in legacy Express entries search endpoint allows disclosure of Express entry dataEPSS 0.3%CVE-2026-18421LOWConcrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not controlEPSS 0.3%CVE-2026-33426LOWDiscourse users can edit or synonymize hidden tags they can't seeEPSS 0.3%CVE-2025-3780MEDIUMWCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings ModificationEPSS 0.3%CVE-2026-76902MEDIUMCordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`EPSS 0.3%CVE-2025-59021MEDIUMTYPO3 CMS Allows Broken Access Control in Redirects ModuleEPSS 0.3%CVE-2026-79116MEDIUMMissing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bEPSS 0.3%CVE-2026-79104MEDIUMMissing authorization in Sensor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process tEPSS 0.3%