Fallos del tipo CWE-264

299 resultados

Controle de acesso e privilégios inadequado

A aplicação não valida ou não implementa corretamente as permissões necessárias para acessar recursos sensíveis, permitindo que usuários realizem operações além do seu nível de privilégio autorizado. Isso pode expor dados confidenciais, modificar informações críticas ou comprometer a integridade do sistema.

Ejemplo

Um usuário comum consegue acessar diretamente uma rota administrativa (/admin/users) porque o backend não verifica se ele é administrador antes de executar a ação, apenas confiando que não tentaria; ou um processo de aplicação roda como root quando precisaria rodar como usuário não-privilegiado, ampliando o impacto de qualquer falha.

Cómo mitigar

Implemente validação de privilégios em todas as operações sensíveis (verificar permissões no servidor, nunca só no cliente), use princípio do menor privilégio (processos e contas com permissões mínimas necessárias), e mantenha matriz de controle de acesso (RBAC ou ABAC) consistente e auditada.

CVE-2025-58309MEDIUMPermission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability will affect availabilEPSS 0.1%CVE-2025-64315MEDIUMConfiguration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data EPSS 0.1%CVE-2026-49308MEDIUMPermission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentEPSS 0.1%CVE-2026-28541MEDIUMPermission control vulnerability in the cellular_data module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-58293MEDIUMVulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-66329MEDIUMPermission control vulnerability in the window management module. Impact: Successful exploitation of this vulnerability may affect availabilEPSS 0.1%CVE-2024-43064HIGHPermissions, Privileges, and Access Controls issue in Automotive OS PlatformEPSS 0.1%CVE-2026-49309MEDIUMPermission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2025-53178MEDIUMPermission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the scheduleEPSS 0.1%CVE-2025-53177LOWPermission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the scheduleEPSS 0.1%CVE-2026-41987MEDIUMPermission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availabilityEPSS 0.1%CVE-2026-49303MEDIUMPermission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-49304MEDIUMPermission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availEPSS 0.1%CVE-2026-49315HIGHDoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-58312MEDIUMPermission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-41962LOWPermission control vulnerability in the app management and control module. Impact: Successful exploitation of this vulnerability may affect EPSS 0.1%CVE-2026-49312MEDIUMPermission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentialEPSS 0.1%CVE-2026-49313MEDIUMPermission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiEPSS 0.1%CVE-2026-41974LOWPermission control vulnerability in service notifications. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%