Falhas do tipo CWE-862

8.577 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2026-22172CRITICALOpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth ConnectionsEPSS 0.6%CVE-2026-12432MEDIUMStripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' ParameterEPSS 0.6%CVE-2026-12994MEDIUMWCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage ControllerEPSS 0.6%CVE-2026-6804MEDIUMAI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX ActionsEPSS 0.6%CVE-2022-39975MEDIUMThe Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check EPSS 0.6%CVE-2026-11995MEDIUMGutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()EPSS 0.6%CVE-2026-12406MEDIUMUser Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' ParameterEPSS 0.6%CVE-2024-33597HIGHWordPress SSU plugin <= 1.5.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-30797CRITICALRustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled ServerEPSS 0.6%CVE-2024-1807MEDIUMProduct Sort and Display for WooCommerce <= 2.4.1 - Missing AuthorizationEPSS 0.6%CVE-2023-44227HIGHWordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File DeletionEPSS 0.6%CVE-2024-3936MEDIUMThe Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing AuthorizationEPSS 0.6%CVE-2026-64746CRITICALAn authorization issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26EPSS 0.6%CVE-2026-86777MEDIUMAlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodesEPSS 0.6%CVE-2023-41848MEDIUMWordPress Carousel Slider plugin <= 2.2.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-33667MEDIUMAn issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack by calling an endpoinEPSS 0.6%CVE-2024-3206MEDIUMDifferent Menu in Different Pages – Control Menu Visibility (All in One) <= 2.3.2 - Missing Authorization to Menu DuplicationEPSS 0.6%CVE-2026-33484HIGHLangflow has Unauthenticated IDOR on Image DownloadsEPSS 0.6%CVE-2023-32798MEDIUMWordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2026-48592MEDIUMMissing authorization check on save-job event handler in oban_webEPSS 0.6%