Fallos del tipo CWE-264

309 resultados

Controle de acesso e privilégios inadequado

A aplicação não valida ou não implementa corretamente as permissões necessárias para acessar recursos sensíveis, permitindo que usuários realizem operações além do seu nível de privilégio autorizado. Isso pode expor dados confidenciais, modificar informações críticas ou comprometer a integridade do sistema.

Ejemplo

Um usuário comum consegue acessar diretamente uma rota administrativa (/admin/users) porque o backend não verifica se ele é administrador antes de executar a ação, apenas confiando que não tentaria; ou um processo de aplicação roda como root quando precisaria rodar como usuário não-privilegiado, ampliando o impacto de qualquer falha.

Cómo mitigar

Implemente validação de privilégios em todas as operações sensíveis (verificar permissões no servidor, nunca só no cliente), use princípio do menor privilégio (processos e contas com permissões mínimas necessárias), e mantenha matriz de controle de acesso (RBAC ou ABAC) consistente e auditada.

CVE-2025-54608MEDIUMVulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: SuccessEPSS 0.1%CVE-2017-9711MEDIUMPermissions, Privileges, and Access Controls in DataEPSS 0.1%CVE-2026-58555MEDIUMPermission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-49315HIGHDoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-49304MEDIUMPermission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availEPSS 0.1%CVE-2023-7265MEDIUMPermission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availabilitEPSS 0.1%CVE-2026-41987MEDIUMPermission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availabilityEPSS 0.1%CVE-2026-58556MEDIUMPermission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-24920MEDIUMPermission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-49309MEDIUMPermission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2026-24931MEDIUMVulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect servEPSS 0.1%CVE-2024-45449MEDIUMAccess permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affectEPSS 0.1%CVE-2023-21641MEDIUMPermissions, Privileges, and Access Controls in DisplayEPSS 0.1%CVE-2026-108788MEDIUMdeepseek-ai deepseek-harness Sandbox spawn sandboxEPSS 0.1%CVE-2025-68967MEDIUMVulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service cEPSS 0.1%CVE-2026-49303MEDIUMPermission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-46587MEDIUMPermission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidEPSS 0.1%CVE-2024-39670MEDIUMPrivilege escalation vulnerability in the account synchronisation module. Impact: Successful exploitation of this vulnerability will affect EPSS 0.1%CVE-2024-5465MEDIUMFunction vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2026-49313MEDIUMPermission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%