Weaknesses of type CWE-862

9,287 results

Falta de verificação de autorização

O software permite que um usuário acesse recursos ou execute ações sem verificar se ele tem permissão para fazê-lo. É a brecha clássica onde o código autentifica (sabe quem é) mas não autoriza (valida se pode). Resultado: usuários comuns acessam dados sensíveis ou administrativos.

Example

Um sistema de e-commerce autentica o cliente, mas ao acessar /pedidos/123, não verifica se o pedido pertence àquele usuário — qualquer cliente logado vê qualquer pedido alheio. Ou um painel administrativo expõe endpoints que deleta contas, mas qualquer conta logada consegue chamar.

How to mitigate

Implemente verificação de autorização em todo endpoint ou ação sensível: valide não só identidade, mas permissões (roles, ACLs, policies). Use middleware ou decoradores (@RequireRole, @Authorize) e teste cenários onde usuários com privileégio baixo tentam acessar recursos alheios ou funções restritas.

CVE-2026-13159MEDIUMReal Estate Papi <= 1.0.5 - Subscriber+ Plugin InstallationEPSS 0.1%CVE-2023-42740HIGHIn telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead tEPSS 0.1%CVE-2023-42747HIGHIn camera service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executiEPSS 0.1%CVE-2023-42736HIGHIn telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executEPSS 0.1%CVE-2026-0024MEDIUMIn isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missinEPSS 0.1%CVE-2023-42698MEDIUMIn omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to EPSS 0.1%CVE-2023-42706MEDIUMIn firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead EPSS 0.1%CVE-2022-47361HIGHIn firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges EPSS 0.1%CVE-2022-44421MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local In wlan driver, information disclosure.EPSS 0.1%CVE-2025-48640HIGHIn multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to reEPSS 0.1%CVE-2018-9406MEDIUMIn NlpService, there is a possible way to obtain location information due to a missing permission check. This could lead to local escalationEPSS 0.1%CVE-2022-20450HIGHIn restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission cEPSS 0.1%CVE-2026-106340MEDIUMMissing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitiEPSS 0.1%CVE-2026-91717MEDIUMMissing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive informatEPSS 0.1%CVE-2026-89121MEDIUMMissing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)EPSS 0.1%CVE-2026-0198MEDIUMIn is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local informationEPSS 0.1%CVE-2025-48591MEDIUMIn multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local iEPSS 0.1%CVE-2022-48249HIGHIn audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executioEPSS 0.1%CVE-2022-48245HIGHIn audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executioEPSS 0.1%CVE-2026-93832MEDIUMA component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions fEPSS 0.1%