Weaknesses of type CWE-264

299 results

Controle de acesso e privilégios inadequado

A fraqueza ocorre quando a aplicação não valida corretamente quem pode fazer o quê, permitindo que usuários acessem recursos ou executem operações acima de seus privilégios. Isso acontece porque as verificações de autorização são ausentes, incompletas ou contornáveis, expondo dados sensíveis ou permitindo ações não autorizadas.

Example

Um usuário comum consegue listar ou modificar dados de outros usuários alterando um ID na URL (ex: /profile/123 → /profile/999) sem que o servidor valide se ele tem permissão para acessar aquele perfil. Ou um atacante executa ações administrativas porque a aplicação só verifica autenticação, não autorização.

How to mitigate

Implemente verificações de autorização em toda operação sensível: valide não apenas se o usuário está logado, mas se ele tem permissão específica para aquele recurso. Use listas de controle de acesso (ACL), roles bem definidas e princípio do menor privilégio. Teste sistematicamente tentativas de escalação e acesso lateral entre usuários.

CVE-2025-58309MEDIUMPermission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability will affect availabilEPSS 0.1%CVE-2025-64315MEDIUMConfiguration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data EPSS 0.1%CVE-2026-49308MEDIUMPermission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentEPSS 0.1%CVE-2026-28541MEDIUMPermission control vulnerability in the cellular_data module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-58293MEDIUMVulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-66329MEDIUMPermission control vulnerability in the window management module. Impact: Successful exploitation of this vulnerability may affect availabilEPSS 0.1%CVE-2024-43064HIGHPermissions, Privileges, and Access Controls issue in Automotive OS PlatformEPSS 0.1%CVE-2025-53178MEDIUMPermission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the scheduleEPSS 0.1%CVE-2025-53177LOWPermission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the scheduleEPSS 0.1%CVE-2026-49309MEDIUMPermission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2026-49303MEDIUMPermission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-49304MEDIUMPermission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availEPSS 0.1%CVE-2026-49315HIGHDoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41987MEDIUMPermission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availabilityEPSS 0.1%CVE-2025-58312MEDIUMPermission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41962LOWPermission control vulnerability in the app management and control module. Impact: Successful exploitation of this vulnerability may affect EPSS 0.1%CVE-2026-49313MEDIUMPermission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2026-49312MEDIUMPermission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentialEPSS 0.1%CVE-2026-41974LOWPermission control vulnerability in service notifications. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%