Weaknesses of type CWE-264

299 results

Controle de acesso e privilégios inadequado

A fraqueza ocorre quando a aplicação não valida corretamente quem pode fazer o quê, permitindo que usuários acessem recursos ou executem operações acima de seus privilégios. Isso acontece porque as verificações de autorização são ausentes, incompletas ou contornáveis, expondo dados sensíveis ou permitindo ações não autorizadas.

Example

Um usuário comum consegue listar ou modificar dados de outros usuários alterando um ID na URL (ex: /profile/123 → /profile/999) sem que o servidor valide se ele tem permissão para acessar aquele perfil. Ou um atacante executa ações administrativas porque a aplicação só verifica autenticação, não autorização.

How to mitigate

Implemente verificações de autorização em toda operação sensível: valide não apenas se o usuário está logado, mas se ele tem permissão específica para aquele recurso. Use listas de controle de acesso (ACL), roles bem definidas e princípio do menor privilégio. Teste sistematicamente tentativas de escalação e acesso lateral entre usuários.

CVE-2024-5465MEDIUMFunction vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2025-66319LOWPermission control vulnerability in the resource scheduling module. Impact: Successful exploitation of this vulnerability may affect serviceEPSS 0.1%CVE-2024-51527MEDIUMPermission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2026-24920MEDIUMPermission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-46587MEDIUMPermission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidEPSS 0.1%CVE-2026-24931MEDIUMVulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect servEPSS 0.1%CVE-2024-21469HIGHPermissions, Privileges, and Access Control issues in TZ Secure OSEPSS 0.1%CVE-2021-25472MEDIUMAn improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrEPSS 0.1%CVE-2025-54608MEDIUMVulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: SuccessEPSS 0.1%CVE-2025-58283MEDIUMPermission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-58302HIGHPermission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2025-58284MEDIUMPermission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-54654MEDIUMPermission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2025-53186MEDIUMVulnerability that allows third-party call apps to send broadcasts without verification in the audio framework module Impact: Successful expEPSS 0.1%CVE-2025-58315MEDIUMPermission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect service confidentialiEPSS 0.1%CVE-2025-58294MEDIUMPermission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentialiEPSS 0.1%CVE-2025-58282LOWPermission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-66325MEDIUMPermission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service EPSS 0.1%CVE-2025-58285MEDIUMPermission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-58276MEDIUMPermission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availabilitEPSS 0.1%