Weaknesses of type CWE-264

309 results

Controle de acesso e privilégios inadequado

A fraqueza ocorre quando a aplicação não valida corretamente quem pode fazer o quê, permitindo que usuários acessem recursos ou executem operações acima de seus privilégios. Isso acontece porque as verificações de autorização são ausentes, incompletas ou contornáveis, expondo dados sensíveis ou permitindo ações não autorizadas.

Example

Um usuário comum consegue listar ou modificar dados de outros usuários alterando um ID na URL (ex: /profile/123 → /profile/999) sem que o servidor valide se ele tem permissão para acessar aquele perfil. Ou um atacante executa ações administrativas porque a aplicação só verifica autenticação, não autorização.

How to mitigate

Implemente verificações de autorização em toda operação sensível: valide não apenas se o usuário está logado, mas se ele tem permissão específica para aquele recurso. Use listas de controle de acesso (ACL), roles bem definidas e princípio do menor privilégio. Teste sistematicamente tentativas de escalação e acesso lateral entre usuários.

CVE-2024-51527MEDIUMPermission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2025-53186MEDIUMVulnerability that allows third-party call apps to send broadcasts without verification in the audio framework module Impact: Successful expEPSS 0.1%CVE-2026-49312MEDIUMPermission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentialEPSS 0.1%CVE-2024-21469HIGHPermissions, Privileges, and Access Control issues in TZ Secure OSEPSS 0.1%CVE-2025-58302HIGHPermission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2021-25472MEDIUMAn improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrEPSS 0.1%CVE-2026-28541MEDIUMPermission control vulnerability in the cellular_data module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-58315MEDIUMPermission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect service confidentialiEPSS 0.1%CVE-2025-53177LOWPermission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the scheduleEPSS 0.1%CVE-2025-58294MEDIUMPermission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentialiEPSS 0.1%CVE-2025-58283MEDIUMPermission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-58309MEDIUMPermission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability will affect availabilEPSS 0.1%CVE-2025-58284MEDIUMPermission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-53178MEDIUMPermission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the scheduleEPSS 0.1%CVE-2025-54654MEDIUMPermission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2025-64315MEDIUMConfiguration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data EPSS 0.1%CVE-2025-58282LOWPermission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-58276MEDIUMPermission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availabilitEPSS 0.1%CVE-2025-58285MEDIUMPermission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-66325MEDIUMPermission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service EPSS 0.1%