Weaknesses of type CWE-441

159 results

Deputado Confuso (Proxy ou Intermediário Não Intencional)

Quando um componente intermediário (servidor, API, função, etc.) executa ações em nome de um cliente sem validar adequadamente quem realmente autorizou aquela ação, um atacante consegue explorar a confiança já estabelecida entre esse intermediário e outros sistemas. O intermediário acaba agindo como 'procurador involuntário' do atacante, realizando operações que o sistema final nunca autorizaria se a requisição viesse diretamente do atacante.

Example

Um servidor de cache proxy que aceita requisições GET de qualquer origem e as repassa a um serviço interno sem verificar se o cliente original deveria ter acesso àqueles dados. Um atacante faz o proxy buscar informações sensíveis do servidor interno e devolver para si, usando a confiança que o servidor interno tem no proxy.

How to mitigate

Valide a identidade e autorização do cliente original antes de repassar requisições para sistemas internos; use tokens ou assinaturas criptográficas que viagem junto com a requisição; implemente listas de origem segura (whitelist) rigorosas e autenticação mútua entre componentes intermediários e backends.

CVE-2026-58739MEDIUMIn platform_msg_handler_init of default_msg_handlers.c, there is a possible confused deputy due to a confused deputy. This could lead to locEPSS 0.1%CVE-2026-56879MEDIUMIn gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of pEPSS 0.1%CVE-2026-58698MEDIUMIn ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission bypass due to a confused deputy. This could lead to local escalEPSS 0.1%CVE-2026-56992MEDIUMIn multiple files, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with SysEPSS 0.1%CVE-2025-36889MEDIUMIn onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local informatioEPSS 0.1%CVE-2026-0183MEDIUMIn CPM, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with System exeEPSS 0.1%CVE-2026-28644HIGHIn startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could EPSS 0.1%CVE-2026-0098HIGHIn getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could EPSS 0.1%CVE-2026-28614HIGHIn onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalaEPSS 0.1%CVE-2026-45519LOWIn screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This coEPSS 0.1%CVE-2026-28636HIGHIn setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy.EPSS 0.1%CVE-2026-28607HIGHIn multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could leadEPSS 0.1%CVE-2026-28616HIGHIn Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalatEPSS 0.1%CVE-2026-56945HIGHIn VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additionaEPSS 0.1%CVE-2026-28624HIGHIn multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could leEPSS 0.1%CVE-2026-28603HIGHIn assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confusedEPSS 0.1%CVE-2026-28600HIGHIn onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead toEPSS 0.1%CVE-2026-77255HIGHMCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issueEPSS —CVE-2026-77246HIGHMCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload PathEPSS —