Weaknesses of type CWE-441

231 results

Deputado Confuso (Proxy ou Intermediário Não Intencional)

Quando um componente intermediário (servidor, API, função, etc.) executa ações em nome de um cliente sem validar adequadamente quem realmente autorizou aquela ação, um atacante consegue explorar a confiança já estabelecida entre esse intermediário e outros sistemas. O intermediário acaba agindo como 'procurador involuntário' do atacante, realizando operações que o sistema final nunca autorizaria se a requisição viesse diretamente do atacante.

Example

Um servidor de cache proxy que aceita requisições GET de qualquer origem e as repassa a um serviço interno sem verificar se o cliente original deveria ter acesso àqueles dados. Um atacante faz o proxy buscar informações sensíveis do servidor interno e devolver para si, usando a confiança que o servidor interno tem no proxy.

How to mitigate

Valide a identidade e autorização do cliente original antes de repassar requisições para sistemas internos; use tokens ou assinaturas criptográficas que viagem junto com a requisição; implemente listas de origem segura (whitelist) rigorosas e autenticação mútua entre componentes intermediários e backends.

CVE-2026-28616HIGHIn Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalatEPSS 0.1%CVE-2026-56945HIGHIn VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additionaEPSS 0.1%CVE-2026-0107HIGHIn gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy. This could lead to locEPSS 0.1%CVE-2025-32326HIGHIn multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. ThEPSS 0.1%CVE-2025-32321HIGHIn isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This cEPSS 0.1%CVE-2025-48555HIGHIn multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This cEPSS 0.1%CVE-2025-48536HIGHIn grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settingsEPSS 0.1%CVE-2025-48529MEDIUMIn setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could EPSS 0.1%CVE-2026-45519LOWIn screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This coEPSS 0.1%CVE-2025-48532HIGHIn markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a confused depuEPSS 0.1%CVE-2025-32346HIGHIn onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This cEPSS 0.1%CVE-2023-21082MEDIUMIn getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java, there is a possible way to enumerate other user's contact phone number EPSS 0.1%CVE-2025-48628HIGHIn validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could leadEPSS 0.1%CVE-2026-106326MEDIUMConfused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions inEPSS 0.1%CVE-2025-22420HIGHIn multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local eEPSS 0.1%CVE-2025-26452HIGHIn loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. ThiEPSS 0.1%CVE-2025-48551MEDIUMIn multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy. This could EPSS 0.1%CVE-2025-22416HIGHIn onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to localEPSS 0.1%CVE-2025-22418HIGHIn multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no EPSS 0.1%CVE-2025-32320HIGHIn System UI, there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilegeEPSS 0.1%