Weaknesses of type CWE-862

9,272 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2022-44435—In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44424MEDIUMIn music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional exeEPSS 0.1%CVE-2025-48549HIGHIn multiple locations, there is a possible way to record audio via a background app due to a missing permission check. This could lead to loEPSS 0.1%CVE-2024-0037LOWIn applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission cEPSS 0.1%CVE-2022-44436MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44437MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2022-44439MEDIUMIn messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additionalEPSS 0.1%CVE-2024-34719HIGHIn multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege EPSS 0.1%CVE-2022-48384HIGHIn srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executionEPSS 0.1%CVE-2025-36192MEDIUMMissing Authorization with the DS8900F and DS8A00 Hardware Management ConsoleEPSS 0.1%CVE-2022-20544MEDIUMIn onOptionsItemSelected of ManageApplications.java, there is a possible bypass of profile owner restrictions due to a missing permission chEPSS 0.1%CVE-2026-47580HIGHNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization isEPSS 0.1%CVE-2022-20536LOWIn registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing permission check. ThiEPSS 0.1%CVE-2022-20537LOWIn createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive settings due to a missinEPSS 0.1%CVE-2022-20533LOWIn getSlice of WifiSlice.java, there is a possible way to connect a new WiFi network from the guest mode due to a missing permission check. EPSS 0.1%CVE-2026-47493HIGHNVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU reEPSS 0.1%CVE-2025-5317MEDIUMImproper access restriction to critical folder in Bitdefender Endpoint Security Tools for MacEPSS 0.1%CVE-2024-43087HIGHIn getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in tEPSS 0.1%CVE-2022-48383HIGH.In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executioEPSS 0.1%CVE-2026-47492MEDIUMNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper acceEPSS 0.1%